hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-04 20:18:37 +02:00
parent 6b820143f8
commit ff1db11db4
45 changed files with 1707 additions and 42 deletions
@@ -787,6 +787,28 @@ its length, and both fixes cost something the household would notice — operato
    controller templates and the golden on every box). Until the fix is released, the demo boxes' root-owned ring-0
    Docker mark is OFF (no unsigned step). *Operator ruling 2026-10-04 ~18:00.*

+### 2026-10-04 (~18:49) — four operator rulings (recorded before the work; the R-840 / Tester 2 brief)
+
+96. **R-840: build the route now, option A** (a signed `agent_config_update` op pinning the agent tag and the sha256 of
+    a config bundle; the root side installs it after its own checks), and use it on Tester 2. Every later box needs it.
+    **This replaces decision 82.** *Operator ruling 2026-10-04 ~18:49.*
+97. **Tester 2 may receive, in this session only:** the signed agent update to the vouched agent; the config bundle
+    through the new route; the one-time `live-restore` reload through the wrapper (a reload, never a restart). Nothing
+    else: no Docker engine step, no reboot, no crash test, no app change. *Operator ruling 2026-10-04 ~18:49.*
+    **Added ~19:05, the operator's answer:** the first bundle cannot reach Tester 2 by the route (its root side predates
+    the route — see `11` §5.4.2); the operator will try to reach Tester 2 through his own WireGuard tunnel and install the
+    one bootstrap file by hand, with CC's written steps.
+98. **drill-r50 is removed from the hub. tester-1 stays** (CC's disposable test box, a VM on the HP box, down when not
+    used). **Added ~19:05, the operator's answer:** the product delete may touch ep0 — it destroys drill-r50's PBS
+    namespace and token there and removes its WireGuard peer. *Operator ruling 2026-10-04 ~18:49 / ~19:05.*
+99. **The operator's cause, with the reviewer's correction:** *"we didn't bake a new golden before he joined."* Partly:
+    the golden carries `live-restore` and the Docker version; the crash guard and the operator-signers file come from the
+    INSTALLER; the wrapper comes from the agent tag the installer pins. A newer golden alone would not have fixed it, and
+    with perfect timing the next wrapper change would still leave Tester 2 behind — that is R-840. **CC's measurement
+    (same evening) corrects the premise further:** Tester 2 was bound at 16:06 **UTC** (18:06 local), after installer
+    1.30.0, agent 0.142.0 and the re-made golden; it lacks only agent 0.142.1's wrapper fix (R-858). *Operator ruling
+    2026-10-04 ~18:49.*
+
 ### 2026-10-04 (evening) — decided by CC unattended — operator may reverse (System page / Docker / crash-restart brief)

 90. **How does a box tell a crash boot from a clean one?** Options: (a) `pstore` — measured on demo-hp: `efi_pstore` is on,