Golden bake — 0.218.0 (2026-08-22)

Baked in the drill VM on DooPlex per documentation/runbooks/RUNBOOK-manual-build.md §4.0/§4.1, carrying controller v0.218.0 (R-354 + R-355).


`GOLDEN_VERSION`	0.218.0
`GOLDEN_SHA256`	8e427869d13eafb71562b77d1535eef6c7f32b4db24f659b988ec6d7db8f478b
package	`https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.218.0/golden.tar.zst`
size	657 026 013 B (archive 626 MB)
controller image	`gitea.dooplex.hu/admin/felhom-controller:0.218.0`
template	`debian-13-standard_13.6-1_amd64.tar.zst` (listed fresh, not assumed)
`MinAgent`	0.129.0 (from the controller CHANGELOG header — unchanged)

Pass markers — each checked, with the negative controls

docker OK (overlay2      : 1     ->  "  docker OK (overlay2; data-root /var/lib/docker)"
including mount point    : 2     ->  rootfs ('/') and mp0 ('/var/lib/felhom')  [there is no mp1]
upload OK (HTTP 201)     : 1     ->  pre-delete returned HTTP 404 (404/204 expected)
excluding                : 0     <- negative control
FATAL                    : 0     <- negative control

Token hygiene

The Gitea token was copied file → file (scp) and read by a runner script inside the VM, so it never crossed a shell or a unit property. Verified: systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)" → 0.

The leak grep on this committed log was itself proven before its zero was believed: the token was appended to a throwaway copy, grepped (1), the copy shredded, and only then was the committed log's 0 accepted.

Teardown

pct destroy 9100 --purge; token, runner, build script and in-VM log shred -u'd after this log was copied out; VM powered off; qemu exited; qemu-img snapshot -a virgin restored.

NOT vouched

The hub's Day-0 artifact manifest was not changed and the floor was not raised — both are the operator's decision. See REPORT.md §12.