# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

---

## felhom-host-install.sh v1.9.0 — Pool.Audit for the stale-lock reaper (A1) (2026-07-03)

**Class:** implementation (this repo's share of the A1 fix; agent side = felhom-agent **v0.62.0**,
see that repo's REPORT for the full evidence). Spec basis:
`documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. Commit **`639a57e`**
(baseline `5e3dfcb`).

**Change:** `PVE_PRIVS_GUEST` gains **`Pool.Audit`** (12 → 13 privs; comment cites the spike and
why `Pool.Allocate` does not satisfy the read), `SCRIPT_VERSION` 1.8.0 → **1.9.0**. No structural
change — `_ensure_role` already `role modify`s to the exact set, so `--rescope-acl` is the
idempotent upgrade path; `remove_scoped_acl` deletes by role name and needed nothing. Gates:
`bash -n` OK, `reuse_refs_check.py` OK (31 paths).

**Live run (felhom-pve, the PUSHED script fetched from Gitea raw):**
`--rescope-acl --vmid 9201` → roles re-ensured; after: `FelhomAgentGuest` =
`Pool.Allocate,Pool.Audit,VM.*…` — Base/Store unchanged. Production-token `GET /pools/felhom`
went 403 → **200 (members [9201])**. Running v0.61.0 agent unaffected; agent v0.62.0 deployed
AFTER the rescope (order per spec) — startup shows
`stale-lock: scanning pool guests pool=felhom listed=1 scanned=1` and 47/47 capabilities incl.
`pve:pool-read` ok (also verified in the hub's stored host report).

**Also in this commit:** REUSE.md §2 errata — the secret-handling row claimed `gitea-creds` is
out-of-band; it is in fact COMMITTED in `manifests/felhom.secret.yaml` AND live-consumed by
hub.yaml. §3 trap row now lists it too. Rotation + de-git of the 3 committed secrets remains a
pending operator task (spike appendix).

**Operator follow-ups:** hub Day-0 artifact manifest → vouch agent **0.62.0**
(sha256 `ed1192c9ae8f355dee19128cf4b01984ba7398e860b4a16a8009655b84b32d81`); secrets rotation above.