# Golden bake 0.212.0 — 2026-08-12

Baked in the drill VM on DooPlex per `RUNBOOK-manual-build.md` §4.0/§4.1. Reverted to `virgin` before
and after; build guest 9100 destroyed `--purge`; `/root` residue check empty.

| | |
|---|---|
| `GOLDEN_VERSION` | **0.212.0** |
| `GOLDEN_SHA256` | **4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8** |
| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.212.0` |
| `MinAgent` (from the controller CHANGELOG header) | **0.127.0** |
| archive | `local:backup/vzdump-lxc-9100-2026_08_12-13_56_29.tar.zst` |
| published | `…/generic/felhom-golden/0.212.0/golden.tar.zst`, 656 611 277 B, `upload OK (HTTP 201)` |
| template | `debian-13-standard_13.6-1_amd64.tar.zst` |
| drill VM | `pve-manager/9.2.2`, kernel 7.0.2-6-pve |

## Acceptance markers — counted with `grep -F` from the start

| marker | count |
|---|---|
| `docker OK (overlay2` | 1 |
| `including mount point rootfs` | 1 |
| `including mount point mp0` | 1 (there is no mp1 — R-165 collapsed the two data volumes) |
| `upload OK (HTTP 201)` | 1 |
| `FATAL` | 0 |
| `excluding` | 0 |

The 0.211.0 run had two of these return a false `0` through shell quoting; this run used `grep -F`
with a quoted loop variable throughout, which is why the counts are trustworthy without a re-run.

## Fetchability — verified on the SERVED bytes

```
downloaded: 656611277 bytes
sha256:     4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8
```

Identical to `GOLDEN_SHA256`. The controller image was independently confirmed retrievable
(`docker manifest inspect …:0.212.0`).

## Secret handling

Token copied file→file, read inside the VM by a runner script, never on a command line.
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>"` = **0**.
Leak grep on the **committed** log = **0**, believable because the grep was first shown to work: a
throwaway copy with the token appended grepped **1**, then was shredded. Token, bake script, runner
and log all `shred -u`'d in the VM.

## NOT DONE

**The Day-0 vouch has not been made** — the operator's. Three fields together:
`golden_version` 0.212.0, `agent_version` 0.128.0, `min_agent` 0.127.0.