hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/web/configs.go

@@ -1320,6 +1320,18 @@ func (s *Server) handleSetArtifacts(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/configuration?flash=artifact_sha_invalid", http.StatusSeeOther)
 		return
 	}
+	// R-840: the vouched agent's CONFIG BUNDLE is resolved from the registry by exact name, like the binary. A version
+	// without one (older than v0.143.0) vouches none — the installer then falls back to its per-file fetches.
+	bundleSHA := ""
+	if agentVer != "" && s.gitea != nil {
+		b, berr := s.gitea.ExactFileSHA256(r.Context(), pkgAgent, agentVer, fileBundle)
+		if berr != nil {
+			s.logger.Printf("[WARN] artifact vouch REFUSED: could not read agent %s's config bundle sha: %v", agentVer, berr)
+			http.Redirect(w, r, "/configuration?flash=artifact_unverifiable", http.StatusSeeOther)
+			return
+		}
+		bundleSHA = b
+	}
 	// R-50b(a): the PBS-DR wrapper hash is operator-typed, not resolved from the package registry —
 	// unlike the agent binary and the golden, this artifact is not published there at all. It is
 	// installed from raw/branch/main, which is exactly the drift this field makes visible.
@@ -1366,12 +1378,13 @@ func (s *Server) handleSetArtifacts(w http.ResponseWriter, r *http.Request) {
 		GoldenSHA256:  goldenSHA,
 		MinAgent:      minAgent,
 		WrapperSHA256: wrapperSHA,
+		BundleSHA256:  bundleSHA,
 	}); err != nil {
 		s.logger.Printf("[ERROR] Failed to set artifact manifest: %v", err)
 		http.Error(w, "Internal error", http.StatusInternalServerError)
 		return
 	}
-	s.logger.Printf("[INFO] Artifact manifest set: agent=%s golden=%s min_agent=%q wrapper_sha=%t", agentVer, goldenVer, minAgent, wrapperSHA != "")
+	s.logger.Printf("[INFO] Artifact manifest set: agent=%s golden=%s min_agent=%q wrapper_sha=%t bundle_sha=%q", agentVer, goldenVer, minAgent, wrapperSHA != "", bundleSHA)
 	// Agent-plane immediate-sync (Direction-2a, v0.59.0): a MinAgent-floor / vouched-agent change is
 	// a fleet-wide agent-plane intent shift. Fire-and-forget nudge every box so it re-reports at
 	// once (the self-update train's signed op / floor re-evaluation lands in seconds, not ≤15 min).

hub/internal/web/server.go

@@ -33,6 +33,7 @@ import (
 const (
 	pkgAgent   = "felhom-agent"
 	fileAgent  = "felhom-agent"
+	fileBundle = "felhom-config-bundle.json" // R-840: the agent's config bundle, beside the binary
 	pkgGolden  = "felhom-golden"
 	fileGolden = "golden.tar.zst"
 )

hub/internal/web/system.go

@@ -31,9 +31,10 @@ type systemRow struct {
 	FactsNote            string
 	// host
 	PVE, KernelRunning, KernelNextBoot, HostDebian cell
-	HostRelease, HostPending, HostNotCovered     cell
-	Held, RebootSince, KernelPanic, Oops         cell
-	CrashRestarts24h, Guard                      cell
+	HostRelease, HostPending, HostNotCovered       cell
+	Held, RebootSince, KernelPanic, Oops           cell
+	CrashRestarts24h, Guard                        cell
+	Bundle                                         cell // R-840: the root-owned config bundle
 	// guest
 	GuestDebian, GuestRelease, GuestPending, GuestRestart cell
 	// docker
@@ -46,13 +47,43 @@ type systemRow struct {
 type OSSystemView interface {
 	Fleet() ([]osupdates.FleetLine, error)
 	Releases() []osupdates.ReleaseInfo
+	CancelledReleases() []osupdates.ReleaseInfo
 	Candidates() []osupdates.Status
 	Thresholds() (stale, reboot, notCovered time.Duration)
+	BundleThreshold() time.Duration
 	ApproveDocker() (string, error)
 }
 
 func plain(s string) cell { return cell{Text: s} }
 
+// bundleCell is the "Root files" cell (R-840): the box's config bundle against the vouched agent's. Amber while behind,
+// red from the alarm's wait on, amber when a file was changed by hand (drift); "unknown" is never coloured as a fact.
+func bundleCell(f sysfacts.System, vouchedAgent, vouchedSHA string, since time.Time, after time.Duration, now time.Time) cell {
+	b := f.Bundle
+	if !f.Present || b.Version == "" || b.Version == sysfacts.Unknown {
+		return unknownCell("")
+	}
+	c := cell{Text: b.Version}
+	switch {
+	case vouchedSHA == "":
+		c.Title = "no vouched bundle to compare with (the vouched agent carries none)"
+	case b.BundleSHA256 != vouchedSHA:
+		c.Class, c.Title = "warn", "behind the vouched agent "+vouchedAgent+"'s bundle — send it with a signed agent_config_update"
+		if !since.IsZero() {
+			c.Title += " (behind since " + since.UTC().Format("2006-01-02 15:04") + " UTC)"
+			if now.Sub(since) >= after {
+				c.Class = "bad"
+			}
+		}
+	}
+	if len(b.Drift) > 0 {
+		c.Text += " (changed by hand)"
+		c.Class = "warn"
+		c.Title = "files differ from the installed bundle: " + strings.Join(b.Drift, ", ")
+	}
+	return c
+}
+
 func unknownCell(s string) cell {
 	if s == "" || s == sysfacts.Unknown {
 		return cell{Text: "unknown", Class: "warn", Title: "the box could not read it (agent older than v0.142.0, or the guest is down)"}
@@ -207,9 +238,16 @@ func (s *Server) handleSystem(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	stale, reboot, notCov := view.Thresholds()
+	rows := buildSystemRows(lines, facts, names, stale, reboot, notCov, time.Now())
+	man := s.store.GetArtifactManifest()
+	for i := range rows {
+		rows[i].Bundle = bundleCell(facts[rows[i].HostID], man.AgentVersion, man.BundleSHA256,
+			s.store.BundleBehindSince(rows[i].HostID), view.BundleThreshold(), time.Now())
+	}
 	data := map[string]interface{}{
-		"Rows":       buildSystemRows(lines, facts, names, stale, reboot, notCov, time.Now()),
+		"Rows":       rows,
 		"Releases":   view.Releases(),
+		"Cancelled":  view.CancelledReleases(),
 		"Candidates": view.Candidates(),
 		"Flash":      r.URL.Query().Get("flash"),
 		"FlashErr":   r.URL.Query().Get("err"),

hub/internal/web/system_bundle_test.go

@@ -0,0 +1,32 @@
+package web
+
+import (
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/sysfacts"
+)
+
+// R-840: the "Root files" cell — amber behind, red from the alarm's wait, amber on drift, unknown never coloured as a fact.
+func TestBundleCell(t *testing.T) {
+	now := time.Date(2026, 10, 4, 20, 0, 0, 0, time.UTC)
+	sys := func(rep string) sysfacts.System { return sysfacts.Parse(rep) }
+	cur := sys(`{"system":{"config_bundle":{"version":"0.143.0","bundle_sha256":"new"}}}`)
+	old := sys(`{"system":{"config_bundle":{"version":"none"}}}`)
+	drift := sys(`{"system":{"config_bundle":{"version":"0.143.0","bundle_sha256":"new"},"facts":{"host":{"config_bundle":{"version":"0.143.0","drift":["/usr/local/sbin/felhom-pbs-apply"]}}}}}`)
+	if c := bundleCell(cur, "0.143.0", "new", time.Time{}, 7*24*time.Hour, now); c.Class != "" || c.Text != "0.143.0" {
+		t.Fatalf("current: %+v", c)
+	}
+	if c := bundleCell(old, "0.143.0", "new", now.Add(-time.Hour), 7*24*time.Hour, now); c.Class != "warn" || c.Text != "none" {
+		t.Fatalf("behind 1 h: %+v", c)
+	}
+	if c := bundleCell(old, "0.143.0", "new", now.Add(-8*24*time.Hour), 7*24*time.Hour, now); c.Class != "bad" {
+		t.Fatalf("behind 8 days: %+v", c)
+	}
+	if c := bundleCell(drift, "0.143.0", "new", time.Time{}, 7*24*time.Hour, now); c.Class != "warn" || c.Title == "" {
+		t.Fatalf("drift: %+v", c)
+	}
+	if c := bundleCell(sys(`{}`), "0.143.0", "new", time.Time{}, 7*24*time.Hour, now); c.Text != "unknown" {
+		t.Fatalf("no stanza: %+v", c)
+	}
+}

hub/internal/web/templates/system.html

@@ -41,9 +41,20 @@
             <div class="rel-grid">
                 {{range .Releases}}
                 <div><strong>{{.Layer}}</strong>: <code>{{.ID}}</code><br>
-                    <span class="text-muted">{{.Packages}} packages · {{.ApprovedAt.UTC.Format "2006-01-02 15:04"}} UTC · by {{.ApprovedBy}}</span></div>
+                    <span class="text-muted">{{.Packages}} packages · {{.ApprovedAt.UTC.Format "2006-01-02 15:04"}} UTC · by {{.ApprovedBy}}</span>
+                    {{if .Test}}<br><span class="c-warn" title="Approved while a TEST wait override was active. It is cancelled when the hub starts without the override (`11` §5.3.1).">TEST approval</span>{{end}}</div>
                 {{else}}<div class="text-muted">No release approved yet.</div>{{end}}
             </div>
+            {{if .Cancelled}}
+            <h3>Cancelled approvals (last 7 days)</h3>
+            <div class="rel-grid">
+                {{range .Cancelled}}
+                <div><strong>{{.Layer}}</strong>: <code>{{.ID}}</code><br>
+                    <span class="c-warn">cancelled {{.Cancelled}} UTC{{if .Test}} — a TEST approval{{end}}</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                {{end}}
+            </div>
+            {{end}}
             <h3>What ring 0 runs now</h3>
             <div class="rel-grid">
                 {{range .Candidates}}
@@ -72,12 +83,12 @@
                 <thead>
                     <tr>
                         <th>Box</th><th>Ring / updates</th><th>Tunnel</th>
-                        <th class="grp">Proxmox</th><th>Kernel (running)</th><th>Kernel (next boot)</th><th>Debian</th><th>Felhom release</th><th>Pending</th><th>Not covered</th><th>Held</th><th>Reboot needed</th><th>kernel.panic</th><th>Oops</th><th>Crash restarts 24 h</th><th>Crash guard</th>
+                        <th class="grp">Proxmox</th><th>Kernel (running)</th><th>Kernel (next boot)</th><th>Debian</th><th>Felhom release</th><th>Pending</th><th>Not covered</th><th>Held</th><th>Reboot needed</th><th>kernel.panic</th><th>Oops</th><th>Crash restarts 24 h</th><th>Crash guard</th><th title="The root-owned config bundle: sudoers, wrappers, units (R-840)">Root files</th>
                         <th class="grp">Guest Debian</th><th>Felhom release</th><th>Pending</th><th>Restart needed</th>
                         <th class="grp">Docker</th><th>containerd</th><th>live-restore</th><th>Docker release</th>
                         <th class="grp">Last OS leg</th>
                     </tr>
-                    <tr class="text-muted"><th></th><th></th><th></th><th class="grp" colspan="13">host</th><th class="grp" colspan="4">guest</th><th class="grp" colspan="4">Docker engine</th><th class="grp"></th></tr>
+                    <tr class="text-muted"><th></th><th></th><th></th><th class="grp" colspan="14">host</th><th class="grp" colspan="4">guest</th><th class="grp" colspan="4">Docker engine</th><th class="grp"></th></tr>
                 </thead>
                 <tbody>
                     {{range .Rows}}
@@ -103,7 +114,7 @@
                         {{template "sys_cell" .KernelRunning}}{{template "sys_cell" .KernelNextBoot}}{{template "sys_cell" .HostDebian}}
                         {{template "sys_cell" .HostRelease}}{{template "sys_cell" .HostPending}}{{template "sys_cell" .HostNotCovered}}
                         {{template "sys_cell" .Held}}{{template "sys_cell" .RebootSince}}{{template "sys_cell" .KernelPanic}}{{template "sys_cell" .Oops}}
-                        {{template "sys_cell" .CrashRestarts24h}}{{template "sys_cell" .Guard}}
+                        {{template "sys_cell" .CrashRestarts24h}}{{template "sys_cell" .Guard}}{{template "sys_cell" .Bundle}}
                         <td class="grp {{if .GuestDebian.Class}}c-{{.GuestDebian.Class}}{{end}}">{{.GuestDebian.Text}}</td>
                         {{template "sys_cell" .GuestRelease}}{{template "sys_cell" .GuestPending}}{{template "sys_cell" .GuestRestart}}
                         <td class="grp {{if .Engine.Class}}c-{{.Engine.Class}}{{end}}">{{.Engine.Text}}</td>