# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

---

# REPORT — Impl-1 Part B: install the guarded-mkfs wrapper (host-install v1.8.0)

**Date:** 2026-07-01 · **Repo:** `felhom.eu` (`scripts/` only) · **Class:** Risky/supervised (paired with
the destructive-path change in felhom-agent v0.54.0).

Companion to felhom-agent v0.54.0 (the format-safety foundation). Script-only change: host-install now
installs the guarded-mkfs wrapper during agent install so every fresh box gets the safe format path.

## 1. Baseline → target

script `v1.7.0` @ `9e5bbc1` → **v1.8.0**. Paired with agent v0.54.0 (separate repo, `5209830`).

## 2. What changed

- `scripts/felhom-host-install.sh` `step_agent_install`: new step (before the sudoers install) that
  `fetch_raw`s `configs/felhom-mkfs-guarded.sh` from Gitea, `bash -n`-validates it, and
  `install -m0755 -o root -g root` → `/usr/local/sbin/felhom-mkfs-guarded`. Wrapper-before-sudoers so
  the sudoers (which allowlists only the wrapper) is never installed ahead of the file it names.
- The agent v0.54.0 sudoers (fetched by the same step) drops raw `mkfs.*` (allowlists only the wrapper)
  and adds read-only `pvs`/`zpool status -P` for the agent's unclaimed-disk guard.
- `scripts/CHANGELOG.md`, version banner. Commit **`7ea36bc`** on `main`.
- `bash -n` + `shellcheck` clean (0 new warnings; the 2 pre-existing SC2015 in `step_verify` unchanged).

## 3. Served-copy version

`curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh | grep SCRIPT_VERSION` → **`1.8.0`**.

## 4. Live validation (felhom-pve, agent v0.54.0 deploy)

The two-layer format guard (agent unclaimed-filter + this wrapper) validated on the demo — details in
`felhom-agent/REPORT.md` §5:
- wrapper REFUSES the OS disk `/dev/sda` and the LVM-PV partition `/dev/sda3`;
- raw `sudo mkfs.ext4 /dev/sda` is DENIED (Part B — wildcard removed);
- an unclaimed throwaway `/dev/sdd` FORMATS (the only real format);
- the agent guard's sudo reads (`pvs`/`lsblk`/`zpool`) all work as the felhom-agent user.

**Deploy note:** installing the sudoers via a manual scp of the Windows working-copy failed `visudo`
(CRLF line endings); fixed live by CR-stripping. The committed repo file is LF, and the host-install
`fetch_raw`-from-Gitea path serves LF — so the shipped path is unaffected. (Lesson recorded.)

## 5. NOT yet live-validated / deferred

- A **fresh install** exercising the new `step_agent_install` wrapper-install step end-to-end (the demo
  was repaired in place; a clean box will exercise the fetch+install path — the code is dry-run-safe and
  mirrors the existing sudoers/unit install).
- **Impl-2** (raw-device discovery + registry enrollment + wizard rewiring) and **Impl-3** (shared-box
  operator gate for self-serve format) are the separate follow-up specs.

## 6. Observations

- The guarded-mkfs wrapper is `configs/felhom-mkfs-guarded.sh` in the **felhom-agent** repo (co-located
  with the sudoers it pairs with); host-install fetches it the same way it fetches the unit/sudoers.