felhom.eu/documentation/tests/golden-0.293.0-2026-10-04/README.md

Golden 0.293.0 — bake + publish, 2026-10-04

Procedure: documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–4, in the drill VM on DooPlex. Step 5 (vouching in the hub, the floor) was not done here — it is the main session's act.

	Previous (../golden-0.292.0-2026-10-04-rebake/)	This bake
build-golden.sh	v3.1.0	v3.2.0 (agent dc9164c, sha256 645b3b659cba…; VM copy matched)
Controller	felhom-controller:0.292.0	felhom-controller:0.293.0 (MinAgent 0.131.0, unchanged)
Docker engine	pinned, approved set	same pinned set: the operator-approved release os-docker-20261004-142842 (stays in force)
Guest packages	template	template — GOLDEN_GUEST_PKGS deliberately EMPTY (see below)

Why the guest list is empty. The only guest release, os-guest-20261004-123933, was approved under a TEST wait; hub v0.133.0 (R-859) cancels it at start. No guest release is in force tonight, so the bake installs no guest fixes, and the box's first night installs whatever release is approved then. The bake reported 49 pending Debian upgrades in the baked guest — what a future approval may bring, NOT what the first night installs (a ring-1 box installs only an approved release; with none in force, 0).

Launch

• Drill VM reverted to virgin, cold-booted per §4.0; pveversion = pve-manager/9.2.2.
• pveam update → update successful; template debian-13-standard_13.6-1_amd64.tar.zst (the only _amd64 debian-13 entry), downloaded, checksum verified.
• /root/bake-run.sh in the VM reads the token from the file and exports GOLDEN_DOCKER_PKGS (the six approved versions) and GOLDEN_GUEST_PKGS=""; launched as transient unit golden-bake.
• Token copied file → file (scp). systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token> = 0 (control with the token appended = 1).

Pass markers (from bake.log)

[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie … docker-ce=5:29.8.2-1~debian.13~trixie …
[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a
[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): 49
  docker OK (overlay2; data-root /var/lib/docker)
  live-restore: on
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.293.0
GOLDEN_SHA256=e7966872abeb38db320e7b26bd9baf6527e87270ed2faf3f0e53763bfc4764b7

No excluding and no FATAL in the log. Pre-delete before upload: HTTP 404 (a new version, nothing replaced).

Round trip

Anonymous GET of …/generic/felhom-golden/0.293.0/golden.tar.zst: HTTP 200, 648135998 bytes, sha256 e7966872abeb38db320e7b26bd9baf6527e87270ed2faf3f0e53763bfc4764b7 = the printed sha (02-round-trip.txt).

Secrets

Saved-log leak grep for the literal token: 0; positive control (a throwaway copy with the token appended): 1, copy shredded.

Teardown

pct destroy 9100 --purge; shred -u of the token, the runner script and the log in the VM (log copied off first); poweroff; qemu gone (ps -eo comm | grep -c qemu-system-x86 = 0); qemu-img snapshot -a virgin. Host: nothing provisioned. Hub: not touched.