# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## R-21 physical run — N100 bare-metal reinstall + onboarding rehearsal — 2026-07-16

Supervised run (Viktor at the box, CC on Phase-0 prep + the SSH-side legs). Full detail:
**`documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md`**. No production code changed.

**Core objectives — GREEN.** The demo N100 (felhom-pve, serving demo-felhom.eu) was reinstalled
clean-slate from a pipeline-built ISO (`felhom-pve-9.2-1-v1.16.0-n100-demo.iso`, profile filter
`ID_SERIAL_SHORT=QDF922W009654S30EX`, appliance). The first-boot chain reached **rc-0 on the first
attempt (`NRestarts=0`)** on real hardware — enrolled `demo-felhom`, provisioned guest 9201, agent
0.88.0, WG up, `bootstrap.env` shredded. This **closes slice A's operator-gated rc-0 boundary on
metal.** Serial-filter safety proven on real hardware (external-HDD canary byte-identical). PBS-DR
reconciler self-healed on the reused peer (all four steps done incl. escrow). DMI verdict on real
cheap hardware: all "Default string" → slice-C keys on **MAC + UUID**.

**The obstacle was firmware, not the pipeline.** This board's early AMI `AN3PLUS 0.01` UEFI cannot
boot the ISO's GRUB **from USB** (`relocation 0x0 is not implemented yet`); Secure-Boot-off and
shim-bypass did **not** help (it's GRUB, not shim). The identical ISO boots in reference UEFI, and the
box's installed GRUB boots fine from the SSD — so it's the firmware relocating the ISO's USB-loaded
GRUB. **Worked around live** by rebuilding the stick's `BOOTX64.EFI` with `grub-mkimage` from the box's
own working `2.12-9+pmx2` GRUB (all needed modules embedded, config that searches+boots the ISO). This
is the top **slice-B input**: the pipeline should ship a firmware-compatible loader and/or a PXE path.

**Findings to tackle (7):** F1 firmware boot loader (HIGH, slice-B); F2 no claim-code re-issue on
reinstall (+ verify open-vs-gated); F3 offsite creds need re-issue on reprovision; F4 PBS-DR 403 —
install ACL grants only default `felhom-pbs`, not the config's `felhom-offsite` storage id; F5 guest
RAM 2 GB not configurable; F6 drive-initialize formats but doesn't mount+attach (client-disconnect
aborts post-mkfs, no UI feedback); F7 storage Back-route → /settings. F2/F3/F4 are reused-customer
clean-slate edges feeding R-1/Peti. BookStack deployed + works.

**Current state:** box healthy, demo-felhom.eu live, guest 9201 running (controller/traefik/cloudflared/
filebrowser/bookstack), external HDD reformatted + attached as `hdd_1`. Onboarding not finished (claim
+ escrow pending on F2/F3/F4). Boot stick (secret-bearing, with the GRUB workaround) to be wiped at
teardown. Findings will be worked next per Viktor.