# Golden bake 0.213.0 — 2026-08-12

Per `RUNBOOK-manual-build.md` §4.0/§4.1. Drill VM reverted to `virgin` before and after; guest 9100
destroyed `--purge`; `/root` residue empty.

| | |
|---|---|
| `GOLDEN_VERSION` | **0.213.0** |
| `GOLDEN_SHA256` | **77429bfc7e39ffc8d25c05b1819b8e0affdc58ccca3d7bd80da4ed9a9e7d1f3c** |
| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.213.0` |
| `MinAgent` (CHANGELOG header) | **0.127.0** |
| published | 656 657 008 B, `upload OK (HTTP 201)` |

## Acceptance markers (`grep -F`, quoted loop variable)

`docker OK (overlay2` 1 · `including mount point rootfs` 1 · `including mount point mp0` 1 ·
`upload OK (HTTP 201)` 1 · `FATAL` 0 · `excluding` 0

## Fetchability — the SERVED bytes

```
downloaded: 656657008 bytes
sha256:     77429bfc7e39ffc8d25c05b1819b8e0affdc58ccca3d7bd80da4ed9a9e7d1f3c
```
Identical to `GOLDEN_SHA256`. Image confirmed retrievable via `docker manifest inspect`.

## Secret handling

Token file→file, read inside the VM by a runner script, never on a command line.
`systemctl show golden-bake` grep = **0**. Leak grep on the committed log = **0**, believable because a
planted-token control grepped **1**. All artefacts `shred -u`'d.

## NOT DONE

The Day-0 vouch — the operator's. Three fields: golden 0.213.0, agent 0.128.0, min agent 0.127.0.