# Golden bake 0.211.0 — 2026-08-10

Baked in the drill VM on DooPlex per `RUNBOOK-manual-build.md` §4.0/§4.1. Reverted to `virgin`
before and after; build guest 9100 destroyed `--purge`.

| | |
|---|---|
| `GOLDEN_VERSION` | **0.211.0** |
| `GOLDEN_SHA256` | **8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849** |
| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.211.0` |
| `MinAgent` (from the controller CHANGELOG header) | **0.127.0** |
| archive | `local:backup/vzdump-lxc-9100-2026_08_10-14_13_46.tar.zst`, 625 MB |
| published | `…/generic/felhom-golden/0.211.0/golden.tar.zst`, 656 141 689 B, `upload OK (HTTP 201)` |
| template | `debian-13-standard_13.6-1_amd64.tar.zst` (checksum verified on download) |
| drill VM | `pve-manager/9.2.2`, kernel 7.0.2-6-pve |

## Acceptance markers — counted, not eyeballed

| marker | count |
|---|---|
| `docker OK (overlay2` | 1 |
| `including mount point rootfs` | 1 |
| `including mount point mp0` | 1 (there is no mp1 — R-165 collapsed the two data volumes) |
| `upload OK (HTTP 201)` | 1 |
| `FATAL` | 0 |
| `excluding` | 0 |

A first attempt at two of these greps broke on shell quoting and returned `0` for markers that were
in fact present. They were re-run with `grep -F` and correct quoting — **a 0 from a broken instrument
is not a measurement**, which is the same class this runbook's own R-233 note is about.

## Fetchability — verified on the SERVED bytes, not the local file

```
curl -fsSL …/generic/felhom-golden/0.211.0/golden.tar.zst
downloaded: 656141689 bytes
sha256:     8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849
```

Matches `GOLDEN_SHA256` exactly. The controller image was independently confirmed retrievable from
the registry (`docker manifest inspect …:0.211.0` → schemaVersion 2); note that an anonymous
`/v2/.../tags/list` returns **401**, which is an auth response and NOT evidence of absence.

## Secret handling

Token copied file→file (`scp`), read inside the VM by a runner script, never on a command line.
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>"` = **0**.
Token-leak grep on the **committed** log = **0**, and that 0 is believable because the grep was first
shown to work: a throwaway copy with the token appended grepped **1**, then was shredded.
Token, bake script, runner and log all `shred -u`'d inside the VM; `/root` residue check empty.

## NOT DONE

**The Day-0 vouch has not been made** — that is the operator's, and this session deliberately did not
make it. Vouching is a THREE-field change: `golden_version` 0.211.0, `agent_version` 0.128.0,
`min_agent` 0.127.0.