Live: https://iso.felhom.eu/felhom-installer-1.26.1-pve9.2-1.iso
sha256 f3cc86d5f0ec68bba4155c994b4fa84e208d50209bb6e815636c99e5441059a6, 1705322496 bytes.
PART 5 PASSED ON BOTH MENU ENTRIES, four observables each:
Graphical spikegfx.felhom.eu pairing code J7N-2DA
TerminalUI spikesix.felhom.eu pairing code ZY5-YY4
Both: manual install, own disk, own password, real completion signal, and the journal's
'not bound yet — polling every 30s ... normal waiting state, not an error'. Spike 4 had REASONED the
graphical path follows from shared Install.pm; it is now measured.
PART 6: G1-G10 + G13 all PASS against the uploaded file. G4's single hit is
felhom-bootstrap.sh:480's substring TEST ('$envtext' != *FELHOM_RETRIEVAL_PASSPHRASE=*), not a
value — my own regex matched the glob's asterisk.
PART 7: uploaded via rclone in a container configured ENTIRELY by environment variables, so no
credential file was ever written. Round trip verified from the public URL — not the local file.
Bucket stays private: unauthenticated GET to the S3 endpoint 400, custom domain has no index (404).
CORRECTED BEFORE UPLOAD: the generated manifest described a single automated entry with a 5s timeout
and listed Graphical/Terminal UI as 'menu-removed'. Generator fixed, sidecar regenerated, and the ISO
verified byte-identical before and after — the published file IS the file Part 5 validated.
Hub-side cleared: appliances 16, 17, 18 discarded (303 each); zero rows remain. The endpoint is
/appliances/<id>/discard, POST only (server.go:345) — not /delete.
Teardown: VMs purged, spike5 storage removed, demo-hp back to 6.6G, drill-r50 and 9201 untouched.
Still open and named: OPEN-ITEMS/ROADMAP dispositions for R-128/R-154/R-155 are not written; the
.deb is not byte-reproducible (G7 sub-clause); before-network stub unreached; Secure Boot and real
hardware not exercised.
iso 1.26.1, sha256 f3cc86d5f0ec68bba4155c994b4fa84e208d50209bb6e815636c99e5441059a6.
Terminal-UI interactive install, host spikesix.felhom.eu — all four observables PASS:
1 package installed ii felhom-bootstrap 1.26.1
2 unit enabled enabled
3 unit fired first boot activating; 'registering unclaimed appliance at the hub'
4 box wants a claim code /etc/felhom/appliance-pairing-code = ZY5-YY4, token 64B mode 600,
'not bound yet — polling every 30s ... normal waiting state, not an error'
That is the product working end-to-end from a public image on a manual install.
G13 added and RED-PROOFED (removing install -d -> exit 3 with the G13 message; restoring -> green).
The first red-proof attempt was INVALID — a copied script failed on a missing control file, i.e.
non-zero for the wrong reason — and was redone in place.
NOT PUBLISHED: Part 5 requires BOTH entries. The Graphical entry reached the Target-Harddisk screen
but was not driven to completion (Enter lands in the Country field; monitor mouse_move does not move
the guest cursor), so Part 5 is not fully passed and Part 7 did not run.
TWO HUB ITEMS OUTSTANDING and NOT disposed of: unclaimed appliances 16 and 17. GET/POST on
/appliances, /appliances/17 and /appliances/17/delete all 404; the rows appear only inside /hosts,
which offers 'Bind & deliver' and no delete affordance. Stated at the top of the report too, because
R-131 is four orphaned objects that recorded commands never cleared.
Also recorded: 'qm set --scsi0 ... --boot' silently yields net0;ide2, and ide2-first sends a finished
install back into the installer — both made a COMPLETED install look like a stuck one.
The Terminal-UI interactive install ran to completion from the release image and gave 3 of 4
required observables:
1 package installed PASS ii felhom-bootstrap 1.26.0
2 unit enabled PASS wants-symlink present; postinst enabled it from the chroot
3 unit FIRED first boot PASS journal shows PAIRING mode, registering unclaimed appliance
4 box wants a claim code FAIL
/etc/felhom/ does not exist on the installed system, so felhom-bootstrap.sh cannot write the
appliance token (:431) or the pairing code (:435), and the hub poll then 401s forever. The box can
never finish pairing and the customer never sees a claim code.
ROOT CAUSE, mine: stub-first-boot.sh opened with 'install -d -m 0755 /etc/felhom /usr/local/sbin'.
This task correctly dropped the env FILE from the package and dropped the DIRECTORY with it.
felhom-bootstrap.sh uses /etc/felhom for its runtime state (token, pairing code, .bootstrap-done).
WHY THE GATE MISSED IT: G9 proves the packaged script is byte-identical to HEAD, and it is. I
verified the payload files and never the directory the payload writes into — a check that proves
the thing present and not the thing it depends on. Added as G13.
The fix is one line and is deliberately NOT applied: a failing Part 5 stops the task, and proving a
fix needs both installs re-run.
Also recorded: 'qm set --scsi0 ... --boot order=scsi0;ide2' silently yields boot: order=net0;ide2,
so a COMPLETED install looked like a machine sitting in the installer. Set --boot separately.
Nothing uploaded; R2 credentials never read. Teardown complete: VMs purged, spike5 storage removed,
demo-hp back to 6.6G, drill-r50 and 9201 untouched. Hub-side: no appliance object was created
(searched /, /hosts, /configs for the hostname — zero hits), so R-131 gains no row.
Publication is gated on Part 5 (two interactive installs proving delivery end-to-end). Neither was
carried to completion, so nothing was uploaded. Per the task: stopping is the good outcome.
BUILT: felhom-installer-1.26.0-pve9.2-1.iso
sha256 24977bafd24d73262745fc1b3040939469c9b23b87ead927a8af86de73044a90, 1705322496 bytes.
GATE (Part 6) against that exact file: G1-G10 PASS, G11/G12 not run (nothing published).
G5 by ENUMERATION vs the stock PVE ISO: exactly four added paths — three felhomtheme files and
/proxmox/packages/felhom-bootstrap_1.26.0_all.deb. G9: the packaged felhom-bootstrap.sh is
byte-identical to repo HEAD. No .rootpw.txt is emitted at all, which is G2's own evidence.
PROVEN in Part 5 before stopping: the image boots to the branded TWO-ENTRY release menu and the
Terminal-UI entry reaches the stock PVE installer. NOT proven: package installed, unit enabled,
unit fired, box asking for a claim code — on either entry. The Graphical entry was never driven.
Reporting partial observables would be the LastRun-class error this arc has corrected three times.
R2 credentials were never read, never used, never echoed; no rclone/aws config was created.
Teardown complete: VMs purged, scratch storage spike5 removed, demo-hp back to 6.6G, drill-r50 and
9201 untouched, hub-side nothing created (verified by fetching the customer list).
admin