# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## RUNBOOK GL-6 — supervised go-live drill (demo box, two full cycles) — 2026-07-08

Full per-phase record: `documentation/pilot/DRILL-GL6-2026-07-08.md`. Supervised, Viktor gating
every phase; destructive (guest 9201 destroyed + rebuilt twice on felhom-pve). Go-live item **G7**
and the live-validation landing zone for GL-1…GL-5b. Ended with the demo healthy on normal life.

**Baselines:** felhom.eu `bd97bc34` → **`87ba30ae`** (host-install `v1.11.1` → **`v1.11.3`** — two
fixes shipped mid-drill). felhom-agent `7f073936` (v0.76.0). Manifest confirmed vouching agent
0.76.0 + golden 0.103.0.

### Result: DRILL COMPLETE — all gates GO

- **Key-pin chain (GL-1's whole point) — legs 1–4 all green:** box==repo==password-manager
  fingerprints; signers ARMED from first boot (byo + appliance); the **pinned operational key
  authorized a real signed `agent_update` round-trip** 0.76.0→0.76.1→0.76.0 (verify vs pinned
  `felhom-op-1` + nonce, A/B swap, dwell, commit, crash-guard silent), throwaway 0.76.1 deleted.
- **Two full destroy/rebuild cycles + two clean uninstalls.** Uninstall: busy-drive prop handled
  (warn+guidance, never `-l/-f`, statement=retry), KEPT/WIPED statement verbatim, host audit clean,
  **drive data intact on all three checks** (witness hash matched). byo (Phase 2) + appliance
  (Phase 6) installs both green; appliance's 4b vaulted the root@pam recovery credential to the hub.
- **C7 live-validated:** an induced pool-membership drop made `step_verify` `log_error` +
  WITH-WARNINGS (read-only); repaired via `--adopt-pool` → green.
- **Drive re-enrollment via the real UI** (Chrome bridge) — additive, pre-drill data reappeared;
  restore-test `mount_parity: ok` on both PBS (5m35s) and local tiers.

### Two fixes shipped mid-drill

1. **host-install v1.11.2 (Gate-0 ruling, G3):** empty customer git creds → **anonymous artifact
   fetch** (the Felhom artifacts are world-readable by operator ruling; the hub-vouched sha256 stays
   the integrity root). All 12 installer fetch targets 200-anon-verified first. Harness `+GL6-ANON`.
2. **host-install v1.11.3 (finding F4, HIGH — Viktor HOLD):** `--resume` fully skipped completed
   producer steps (`should_skip X || step_X`), but token/enroll/grows produce in-memory outputs
   later steps consume → a resumed install wrote a config missing `hub.host_id`/`proxmox.token`
   (daemon crash-loop) and passed `-rootfs-grow ""` (flag parse error). Fix: those three re-run every
   pass (idempotent); golden's volid re-derived from local. **Live-proven** (crafted dry-resume +
   the subsequent appliance install ran single-shot). Harness `+GL6-F4`; 27/27; shellcheck clean.

### Findings filed (small installer follow-up, none block Peti)

F1 config `.bak` residue on uninstall · F2 per-drive `mnt-*.mount` residue · F3 byo fresh install on
a populated host needs `--allow-new-leaf` (guard counts any guest) · F6 leftover broken dnsmasq
breaks LAN-client DNS on a byo host · F7 pool re-assert is bring-up-only (no continuous heal;
`--adopt-pool` repairs). (F5 was a self-corrected misdiagnosis — the public DNS wildcard works.)

### Deferred to GL-7 (with Peti)

Dashboard password (operator-set via hub — G9) + geo-restriction; **G10** (public dashboard is open
until the operator sets a password) is a GL-7 prerequisite. Full demo app redeploy + LAN-DNS
alignment (re-provision changed the guest DHCP IP) are Viktor's return-to-normal.

### Honest leftovers (unchanged)

S5 customer-data DR drill; G12 parity-on-real-drift + PBS-tier runtime; CGNAT retest; Impl-3;
OOB spike. **Next: GL-7** (Peti's day-0 runbook + tester agreement).