admin
00f26c4f06
Overwrites REPORT.md per convention: evidence bundle manifest, the map rows flipped with citations, ROADMAP IDs assigned (R-30..R-39 + R-27c), the seven discrepancies found against the brief, and the remaining-to-first-invite line. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
151 lines
9.1 KiB
Markdown
151 lines
9.1 KiB
Markdown
# felhom.eu — task reports
|
||
|
||
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
||
|
||
## N100 rehearsal S8 wrap — evidence, VALIDATION, map flips, ROADMAP, R-3 — 2026-07-18
|
||
|
||
**Class:** documentation/evidence run. **Repos touched:** `felhom.eu` only, docs only.
|
||
**No code changed anywhere** — every finding is recorded and ranked, none fixed (campaign discipline).
|
||
|
||
**Commit:** `aa9c08f` — *docs(rehearsal): N100 S8 wrap — VALIDATION, map flips, ROADMAP R-30..R-39,
|
||
R-3 draft* (pushed to `main`; parent `bbaa844`).
|
||
|
||
No CHANGELOG entry: `felhom.eu` keeps per-area changelogs (`hub/`, `scripts/`, `website/`) and this
|
||
run touched none of those areas.
|
||
|
||
### What the run proved
|
||
|
||
The complete final-product flow ran **end to end on real metal in one pass**: RESET → generic
|
||
pairing ISO v1.20.0 → **customer self-bind** → credential delivery → day-0 → managed-floor lift →
|
||
drive enrolment → escrow ceremony → offsite snapshots.
|
||
|
||
| Leg | Wall-clock |
|
||
|---|---|
|
||
| Blank-metal boot → registered as an unclaimed appliance | **< 1 s** |
|
||
| Bind → credential delivered | **26 s** |
|
||
| Bind → controller running the CURRENT version | **2 min 44 s** |
|
||
| Managed floor 0.143.0 → 0.145.0 (`initiated_by: auto-floor`) | **5 s**, unattended |
|
||
| Escrow ceremony → offsite runs enabled | **12 s** |
|
||
| Drive enrol (confirm → usable, incl. mkfs) | **30.3 s** |
|
||
|
||
**No post-bind leg stalled** — that is the immediacy row's real-onboarding proof.
|
||
|
||
---
|
||
|
||
## Phase A — evidence bundle (completed before the box was unplugged)
|
||
|
||
`180:~/n100-rehearsal/` — 984 KB, 10 files + `MANIFEST.md`:
|
||
|
||
| File | Evidences |
|
||
|---|---|
|
||
| `bootstrap-journal.txt` | first boot 16:17:14 UTC, PAIRING mode, unclaimed registration, the 30 s poll loop and its **52 systemd FAILED lines**, day-0 SUCCESS 16:32:32 |
|
||
| `host-state.txt` | `pct config 9201` (12288 MB), `pveversion -v`, `pvesm status` (**felhom-pbs 401/inactive**), `lsblk`, `blkid` |
|
||
| `guest-docker.txt` | 11 containers, controller 0.145.0 healthy, image pin |
|
||
| `controller-log-full.txt` / `controller-log.txt` | the whole controller life: auto-floor update, 16:55 config-refresh restart, escrow ceremony, orphan guard, both backup runs |
|
||
| `agent-journal.txt` | agent 0.90.0 start, WG registration, storage-wipe gate pending→confirmed, format + enrol, PBS apply, and the repeating PBS verify-loop permission error |
|
||
| `pbs-dr-state.txt` | the R-39 failure: storage.cfg stanza, `pvesm status`, credential metadata, direct token probe (401 everywhere), WG health, agent errors |
|
||
| `restic-and-pool.txt` | 2 snapshots / **48.717 MiB** attributed, pool `/home` listing + `du` showing **1.4 G + 3.0 M unattributed** |
|
||
| `hub-state.txt` | hosts row, both RESET ledger rows, the **unconsumed** PBS secret, self-bind token lifecycle, appliance registration, events timeline |
|
||
| `hub-events-timeline.txt` | the 15-row demo-felhom event stream from 15:50 |
|
||
| `timezones.txt` | the live-captured CEST/UTC split |
|
||
|
||
Secrets were read only to run probes and are recorded as lengths and metadata, never as values.
|
||
|
||
**Not collected:** the operator gauge screenshots (Viktor's set) and the **PBS DR tab**, which
|
||
remains uncaptured — and now matters more, because R-39 means it would have shown a fault. The hub
|
||
UI is password-gated, so CC cannot capture it.
|
||
|
||
---
|
||
|
||
## Phases B–E — what landed
|
||
|
||
- **Phase B** — `documentation/tests/VALIDATION-n100-rehearsal-2026-07-18.md`: run context, a
|
||
**UTC-normalised** timeline (the host journal is CEST, everything else UTC — a 2 h trap), derived
|
||
wall-clocks, per-ledger verdicts for S1–S8 plus ledgers 8 and 9, 12 findings, the not-exercised
|
||
list, and the discrepancy table.
|
||
- **Phase C** — 10 capability-map rows annotated, each citing the Phase-B doc.
|
||
- **Phase D** — 5 items collapsed, 11 new ranked items, 1 pre-invite checklist.
|
||
- **Phase E** — Viktor's draft (which landed as `runbooks/RUNBOOK-onboarding-draft-v3.md`, not the
|
||
filename the brief predicted) refined: all four `[REFINE]` slots filled, self-bind made the default
|
||
bind path, the measured wall-clock table inlined, interim workarounds for R-31/R-36/R-39 added, and
|
||
C6→C7 marked as the single unexecuted step. **Committed as DRAFT** — it graduates when C7 has
|
||
evidence.
|
||
|
||
### Capability-map rows flipped
|
||
|
||
| Row | Change |
|
||
|---|---|
|
||
| Bare-metal Felhom ISO | PARTIAL → **PROVEN-LIVE** — F1 closed on physical hardware |
|
||
| Customer self-bind (slice 1) | IMPLEMENTED → **PROVEN-LIVE** — `customer_selfbind`, 0 failed attempts |
|
||
| Guest RAM resize (R-24) | IMPLEMENTED → **PROVEN-LIVE** — shrink **and** grow, live cgroup |
|
||
| Customer RESET | + two real firings, verified external teardown, orphan-guard interaction |
|
||
| Escrow ceremony | + first live customer-facing wizard firing |
|
||
| Immediacy | "real-onboarding proof pending" **cleared** |
|
||
| Publish train / floor | + box-side floor lift proven on a fresh install |
|
||
| Customer claim | + R-4 gmail half (Inbox under `p=quarantine`) |
|
||
| Offsite orphan guard | staged live leg **fired on its own** |
|
||
| **DR tier by default** | candidate PROVEN-LIVE upgrade **WITHDRAWN** (R-39) |
|
||
|
||
**Not flipped, as instructed:** customer-performs-restore (still MISSING), BYO, DLNA, multi-user.
|
||
|
||
### ROADMAP IDs assigned
|
||
|
||
| Rank | IDs |
|
||
|---|---|
|
||
| P2-HIGH | **R-39** PBS DR applied-but-dead · **R-30** liveness from the wait channel · **R-31** async offsite + status card · **R-32** RESET base-dir purge + orphan-card honesty + unattributed-bytes gauge · **R-33** bootstrap console quiet-poll |
|
||
| P2 | **R-34** backup data lifecycle · **R-35** config-apply session survival · **R-36** post-RESET re-enroll offsite prompt · **R-27c** console-passphrase bind |
|
||
| P3 | **R-37** post-RESET health card · **R-38** installer GRUB slice |
|
||
|
||
Collapsed: **R-1** (appliance half done; Peti half survives), **R-21** (physically closed), **R-24**,
|
||
**R-27** slice 1, **R-4** (gmail half). No existing item renumbered.
|
||
|
||
---
|
||
|
||
## Discrepancies found vs the brief (live evidence won in each case)
|
||
|
||
1. **"expect ~11675 MB" vs `pct config` 12288 MB.** Both correct at different times: F5 auto-sized to
|
||
11675, then the customer shrank to 8192 (16:50:22) and grew to 12288 (17:02:17). Not a fault —
|
||
it is what completes ledger 9.
|
||
2. **"2.6 GB pool vs ~0 attributed"** → measured **1.4 G + 3.0 M** unattributed vs **49 M**
|
||
attributed, across **two** `.orphaned-*` directories, not one. The R-32 ruling is unaffected; the
|
||
numbers are.
|
||
3. **"felhom-pbs entry present"** → present but **401 / inactive**. The brief treated the descriptor
|
||
as done; it is provisioned but dead. → R-39.
|
||
4. **"RESET ×2 … second + third live firings"** → the ledger holds **exactly two rows, both
|
||
tonight**, on **two different customers** (`demo-vm-felhom` 15:49:57, `demo-felhom` 16:08:51).
|
||
Recorded as tonight's two firings rather than as ordinals.
|
||
5. **"keep R-29 if the number is free"** → **it is not free.** R-29 was committed earlier the same day
|
||
(`2eccda4`) for the design-v2 gate rot — which *is* the brief's item 5. So the liveness item took
|
||
**R-30**, and **no new ID was minted for the red-gate item**.
|
||
6. **Tip and filename:** the brief's tip `a03e142` is two commits behind `bbaa844`, and Viktor's R-3
|
||
draft landed as `RUNBOOK-onboarding-draft-v3.md`, not `DRAFT-R3-onboarding-runbook.md`.
|
||
7. **R-39 has no counterpart in the brief at all** — it was found by probing the box, not by working
|
||
the finding list. Its P2-HIGH rank is therefore **provisional pending Viktor**.
|
||
|
||
### The one finding worth reading twice
|
||
|
||
**R-39 — the DR tier can report `applied` and be dead simultaneously.** The descriptor
|
||
auto-provisioned and the agent converged `state=applied` at 16:45:53. But `pvesm status` returns
|
||
`401 Unauthorized`/`inactive`, and a direct probe with the stored credential 401s on **every**
|
||
endpoint including `/version` while the WG transport is healthy (handshake 9 s, 27.9 ms RTT) — so it
|
||
is authentication, not ACL scope. The hub minted a **second** token secret at 16:47:52, two minutes
|
||
*after* the agent applied the first, and its `consumed_at` is **still NULL**; the converged state
|
||
machine will not re-apply, and the agent's 15-minute verify loop **cannot read the credential to
|
||
notice**, because it reads directly as non-root a file it writes through a root sudo wrapper. A
|
||
silent DR failure surfaces first at a restore, which is the worst possible moment — hence the
|
||
withdrawn map upgrade and the interim `pvesm status` check now in R-3 step E1.
|
||
|
||
---
|
||
|
||
## Remaining to first invite
|
||
|
||
**freemail.hu test-send (Viktor, remote-doable) + C6 customer-restore evidence (remote-doable on the
|
||
reborn box from vacation — the dashboard is remote) + R-11 rulings (contact channel, agreement,
|
||
thresholds) + golden 0.145.x rebuild.**
|
||
|
||
R-39 is not on that line because it was discovered after the brief was written; if Viktor confirms
|
||
the P2-HIGH rank, it belongs there too — a first tester whose DR tier is silently dead is exactly the
|
||
scenario the alpha exists to avoid.
|
||
|
||
Viktor's polish/tweak notes arrive separately and are neither pre-empted nor invented here.
|