felhom.eu/documentation/pilot/RUNBOOK-publish-0.85-0.120-2026-07-12.md

RUNBOOK results — publish train agent 0.85.0 + golden 0.120.0 + floor (fleet half; Peti parked) (2026-07-12)

Class: publish/signing runbook (GL-1 pattern) — the CAMPAIGN-3 wave fleet train. Status: Fleet half COMPLETE — Phases 0/A/B/C done, Phase F env floor moved + verified. Phase D/E/G (Peti peti-felhom-86d37d, sajatfelhom.hu) PARKED: his server is offline (dead fan) as of this date, so no op was signed for it — the MinAgent-0.81 gate protects him automatically until he returns. One remaining fleet step is the operator's: save the DB global floor to 0.120.0 (last). No credential or signature-key material in this doc.

The operator values (saved in the hub Day-0 manifest — UI-confirmed byte-identical)

AGENT_VERSION=0.85.0
AGENT_SHA256=31babb2c4f8fa5a1f961428519a0dfbb3a19b6e536fba01c2664afca339da93d
GOLDEN_VERSION=0.120.0
GOLDEN_SHA256=f7d7d02c76b49891719df9cf68624c9ae193e438e2a3a63b948a2a9d12887596
MIN_AGENT=0.81.0
FLOOR (env, GitOps 0eb9dc2)=0.120.0     ← live in the pod
FLOOR (DB hub_settings)=0.113.0         ← operator saves 0.120.0 LAST (effective floor until then)

Gate outcomes (Phase 0)

Gate	Result	Evidence
0a Peti online	OFFLINE (expected)	dead fan; fleet publish proceeds, Peti rollout parks — never sign an op for an offline host
0c immutability pre-gate	PASS	agent 0.85.0 GET 404 + golden 0.120.0 GET 404; controls (agent 0.79.0 / golden 0.113.0) = 200 → proves anonymous GET works, so the 404s are truly-unpublished not auth failures
0d live bytes	PASS	felhom-pve binary v0.85.0, sha 31babb2c…39da93d, 13 629 759 B (deployed artifact of main@bcb8dad2)
0e golden source	PASS	docker manifest inspect …/felhom-controller:0.120.0 OK on 180
0f hub healthy	PASS	ArgoCD app felhom Synced/Healthy; hub image 0.48.0
0b/0g Peti creds+key	PARKED	Peti-only; deferred with D/E/G until his box returns

Phase A — agent 0.85.0 published

Live felhom-pve bytes; sha identical across felhom-pve → CC → 180 (31babb2c…39da93d); publish-agent.sh 0.85.0: pre-GET 404 → PUT 201 → round-trip sha match → anonymous off-LAN GET 200 (13 629 759 B, sha == AGENT_SHA256). Token from ~/.gitea-token env-substituted on 180; token-leak grep of the transcript: 0.

Phase B — golden 0.120.0 baked + published

Recorded drill-VM procedure (RUNBOOK-publish-0.79-0.110 Phase C): qemu-img snapshot -a virgin → cold boot → PVE 9.2.2 up on :2222 in ~9 s → debian-13 template pveam download (checksum OK; absent on virgin) → build-golden.sh v2.0.0 as transient unit golden-bake baking felhom-controller:0.120.0: docker OK (overlay2), both extra volumes separate mounts, all 3 mounts included (rootfs+mp0+mp1, no exclusions/FATAL), archive 583 MB → pre-delete 404 → upload 201. Verified: integrity round-trip anonymous GET | sha256sum == GOLDEN_SHA256 (612 309 180 B)

• off-LAN ranged GET 206. Teardown: guest 9100 purged, token/script/log shredded in-VM, clean poweroff, qcow2 reverted to virgin (snapshot intact), ~/drill/bake-0.120.0.log retained, saved-log token-leak grep 0.

Phase C — hub Day-0 manifest (operator)

Saved by Viktor; UI banner "Artifact manifest saved" + the Day-0 card shows agent 0.85.0 / 31babb2c…39da93d, golden 0.120.0 / f7d7d02c…887596, Min agent 0.81.0. The sha the hub auto-reads from Gitea matched the published artifacts byte-for-byte — independent cross-validation of the right bytes. Save did not move the floor (separate card since v0.45), as intended.

Phase D/E/G — Peti (PARKED, box offline)

Not executed. Peti's box (peti-felhom-86d37d) is offline (dead fan). Per the runbook, no signed op is issued for an offline host. When he returns, the sequence is: sign agent_update 0.79→0.85 (sha 31babb2c…39da93d, ttl 30m) → confirm agent 0.85 reports → THEN his controller updates. Until his agent reports ≥0.81 the conditional-floor gate holds his controller at 0.113 — the intended safety, not a fault. His 0.79.0 fallback stays published for a reverse op if needed (sha 35a162547646737ebef265f5ad69d042e897914f6ca799c007872d1c3cd27561). Journal-group one-liner (E) and temp-Git-Sync-creds deletion (G1) travel with his return; both LOW priority as he has no NAS share yet (F12 fix is latent-protective for him).

Phase F — floor

Env fallback (GitOps, CC): manifests/hub.yaml DEFAULT_MIN_CONTROLLER_VERSION 0.113.0 → 0.120.0 (commit 0eb9dc2), ArgoCD hard-refresh + deliberate sync → Synced/Healthy, hub rolled out, live pod printenv == 0.120.0. Demo: no churn (already 0.120.0).

DB global floor (operator, LAST): NOT moved by CC — it is the operator's hub_settings save and takes precedence + acts immediately (the 9-minute-skew lesson: save it last). Until the operator saves 0.120.0 there, the fleet's EFFECTIVE floor remains 0.113.0 (DB wins over the env fallback). Blast radius of the save is zero online boxes (demo already 0.120; Peti offline), and it is required so Peti reaches 0.120 after his agent lands.

Deviations from the letter of the runbook

1. Peti offline at train time → the entire Peti arc (D/E/G) parked; only the fleet artifacts (A–C) + env floor (F-fleet) ran. No skew risk: his box is gated (agent 0.79 < MinAgent 0.81).
2. DB floor left at 0.113.0 by CC (operator-only + saved-last). Consequence to remember: the effective floor is still 0.113.0 until the operator saves — env 0.120.0 is only the fallback. No live impact given the fleet shape, but Peti's eventual 0.120 hinges on this save.

Security notes

• No key material or tokens in any transcript; publish creds stayed as $(cat ~/.gitea-token) env-substitution on 180; drill-VM token shredded; saved-log leak grep 0.
• ⚠ ROTATION STILL DUE: the hub operator bearer key is COMMITTED in git (manifests/hub.yaml) — carried over from the 0.81/0.113 train. Rotate + move to a secretKeyRef (Resend-key pattern, documentation/runbooks/secrets.md) as an operator hygiene task.

END STATE

Item	State
Agent 0.85.0 published + anon-fetchable + sha-verified	✅ 31babb2c…39da93d (13 629 759 B)
Golden 0.120.0 published + anon-fetchable + sha-verified	✅ f7d7d02c…887596 (612 309 180 B)
Hub manifest vouches both (MinAgent 0.81.0)	✅ UI-confirmed
Env floor 0.120.0 (GitOps 0eb9dc2)	✅ Synced/Healthy, live pod verified
DB global floor 0.120.0	⏳ operator — save LAST (effective floor 0.113.0 until then)
Demo: unchanged (0.120.0 / 0.85.0)	✅ no churn
Drill VM	✅ reverted to virgin; ~/drill/bake-0.120.0.log retained
Peti agent 0.85 + controller 0.120	⏸ PARKED — box offline (dead fan); gate holds him at 0.113 until his agent lands
Phase E journal group on Peti's host	⏸ with his return (LOW — no NAS share yet)
G1 delete Peti temp Git Sync creds	⏸ with his return
Hub bearer key rotation	⏳ operator — see Security notes