hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-04 20:18:37 +02:00
parent 6b820143f8
commit ff1db11db4
45 changed files with 1707 additions and 42 deletions
@@ -1,3 +1,20 @@
+## felhom-host-install.sh 1.31.0 — the root-owned files come from the agent's config bundle (R-840) (2026-10-04)
+
+Needs a vouched agent ≥ 0.143.0 for the bundle (hub ≥ 0.133.0 serves its sha); an older vouched agent: the per-file
+path of 1.30.0, unchanged, with a warning.
+
+- **One source of truth.** Step 5 fetches `felhom-config-bundle.json` of the vouched agent from the package registry,
+  verifies its sha256 against the hub manifest (`bundle`), takes out the bundle's own `felhom-os-apply` (checked against
+  its entry, parsed), installs it and runs `felhom-os-apply --install-bundle` — the SAME code that installs a signed
+  `agent_config_update` on an installed box: every root-owned file (sudoers, the five wrappers, the crash guard and its
+  units, the agent and rollback units, the start-limit drop-in, the mgmt watchdog, the OOB belt's files), every check
+  before the first write, a self-check after, the previous copies kept, everything put back on a failure. The OOB
+  directory and user are created first so the bundle writes the belt's files; the host key, the belt loader and the
+  unit enables stay here.
+- Uninstall also removes `/etc/felhom/config-bundle.json` and `/var/lib/felhom-os-apply`.
+- New: `scripts/felhom-bundle-bootstrap.sh` — the ONE by-hand step an installed box from before agent 0.143.0 needs
+  (installs only the bundle-aware `felhom-os-apply`, checked against the vouched bundle); `11` §5.4.2.
+
 ## felhom-host-install.sh 1.30.0 — the crash guard and the slow-lane trust files (2026-10-04)

 Needs agent ≥ 0.142.0 at the pinned tag for the crash guard (an older agent: skipped with a warning, the box keeps