# Golden bake — 0.220.2 (2026-08-22)

Baked in the drill VM on DooPlex per `documentation/runbooks/RUNBOOK-manual-build.md` §4.0/§4.1,
carrying controller **v0.220.2** (R-379/R-380/R-381/R-382 — the rollback, the hold, and the two
defects the live walk found in them).

| | |
|---|---|
| `GOLDEN_VERSION` | **0.220.2** |
| `GOLDEN_SHA256` | **cb439418c7005ce01bcb8126bb6385688c2f408c3c4649f6740001bc2c864ed5** |
| package | `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.220.2/golden.tar.zst` |
| size | 657 271 965 B |
| controller image | `gitea.dooplex.hu/admin/felhom-controller:0.220.2` |
| template | `debian-13-standard_13.6-1_amd64.tar.zst` (**listed fresh**, checksum verified on download) |
| `build-golden.sh` | v3.0.0, from `felhom-agent` @ `40d857b52711` |
| `MinAgent` | **0.129.0** (from the controller CHANGELOG header — unchanged) |

## Why this bake happened in this session

The `golden-currency` gate refused the docs push: controller 0.220.2 was released with no golden
carrying it. **That block is not circular** — a golden needs the controller image, which was already
built and pushed, not the docs commit. So the gate was satisfied by doing the work it asked for,
rather than bypassed with `--no-verify`.

## Pass markers — each checked, with the negative controls

```
docker OK (overlay2      : 1     ->  "  docker OK (overlay2; data-root /var/lib/docker)"
including mount point    : 2     ->  rootfs ('/') and mp0 ('/var/lib/felhom')  [there is no mp1]
upload OK (HTTP 201)     : 1     ->  pre-delete returned HTTP 404 (404/204 expected)
excluding                : 0     <- negative control
FATAL                    : 0     <- negative control
```

**The 404 pre-gate was controlled before it was believed:** the same URL shape for **0.219.0 returned
HTTP 200** in the same minute, so the 404 on 0.220.2 means absent, not a wrong URL.

## Verified by ROUND TRIP

The published object was downloaded again — **HTTP 200, 657 271 965 bytes** — and its sha256
recomputed: `cb439418…` on both sides. What a machine receives is byte-identical to what was baked.

## Token hygiene

Copied **file → file** and read by a runner script inside the VM.
`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"` → **0**,
and that grep was **proved able to convict first** (planted copy → **1**, copy shredded).
The same control was run on the **committed** `bake.log`: **0**, positive control **1**.

## Teardown

`pct destroy 9100 --purge`; token, runner, build script and in-VM log `shred -u`'d **after** `bake.log`
was copied out to this directory — all four confirmed absent; `poweroff`; waited for qemu to exit;
`qemu-img snapshot -a virgin`.

## NOT vouched

The hub's Day-0 artifact manifest was **not** changed and the floor was **not** raised. Both are the
operator's, and it is a **three-field** save:

| field | value |
|---|---|
| `golden_version` | **0.220.2** |
| `agent_version` | **0.130.0** |
| `min_agent` | **0.129.0** |