felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

RUNBOOK GL-6 — supervised go-live drill (demo box, two full cycles) — 2026-07-08

Full per-phase record: documentation/pilot/DRILL-GL6-2026-07-08.md. Supervised, Viktor gating every phase; destructive (guest 9201 destroyed + rebuilt twice on felhom-pve). Go-live item G7 and the live-validation landing zone for GL-1…GL-5b. Ended with the demo healthy on normal life.

Baselines: felhom.eu bd97bc34 → 87ba30ae (host-install v1.11.1 → v1.11.3 — two fixes shipped mid-drill). felhom-agent 7f073936 (v0.76.0). Manifest confirmed vouching agent 0.76.0 + golden 0.103.0.

Result: DRILL COMPLETE — all gates GO

• Key-pin chain (GL-1's whole point) — legs 1–4 all green: box==repo==password-manager fingerprints; signers ARMED from first boot (byo + appliance); the pinned operational key authorized a real signed agent_update round-trip 0.76.0→0.76.1→0.76.0 (verify vs pinned felhom-op-1 + nonce, A/B swap, dwell, commit, crash-guard silent), throwaway 0.76.1 deleted.
• Two full destroy/rebuild cycles + two clean uninstalls. Uninstall: busy-drive prop handled (warn+guidance, never -l/-f, statement=retry), KEPT/WIPED statement verbatim, host audit clean, drive data intact on all three checks (witness hash matched). byo (Phase 2) + appliance (Phase 6) installs both green; appliance's 4b vaulted the root@pam recovery credential to the hub.
• C7 live-validated: an induced pool-membership drop made step_verify log_error + WITH-WARNINGS (read-only); repaired via --adopt-pool → green.
• Drive re-enrollment via the real UI (Chrome bridge) — additive, pre-drill data reappeared; restore-test mount_parity: ok on both PBS (5m35s) and local tiers.

Two fixes shipped mid-drill

1. host-install v1.11.2 (Gate-0 ruling, G3): empty customer git creds → anonymous artifact fetch (the Felhom artifacts are world-readable by operator ruling; the hub-vouched sha256 stays the integrity root). All 12 installer fetch targets 200-anon-verified first. Harness +GL6-ANON.
2. host-install v1.11.3 (finding F4, HIGH — Viktor HOLD): --resume fully skipped completed producer steps (should_skip X || step_X), but token/enroll/grows produce in-memory outputs later steps consume → a resumed install wrote a config missing hub.host_id/proxmox.token (daemon crash-loop) and passed -rootfs-grow "" (flag parse error). Fix: those three re-run every pass (idempotent); golden's volid re-derived from local. Live-proven (crafted dry-resume + the subsequent appliance install ran single-shot). Harness +GL6-F4; 27/27; shellcheck clean.

Findings filed (small installer follow-up, none block Peti)

F1 config .bak residue on uninstall · F2 per-drive mnt-*.mount residue · F3 byo fresh install on a populated host needs --allow-new-leaf (guard counts any guest) · F6 leftover broken dnsmasq breaks LAN-client DNS on a byo host · F7 pool re-assert is bring-up-only (no continuous heal; --adopt-pool repairs). (F5 was a self-corrected misdiagnosis — the public DNS wildcard works.)

Deferred to GL-7 (with Peti)

Dashboard password (operator-set via hub — G9) + geo-restriction; G10 (public dashboard is open until the operator sets a password) is a GL-7 prerequisite. Full demo app redeploy + LAN-DNS alignment (re-provision changed the guest DHCP IP) are Viktor's return-to-normal.

Honest leftovers (unchanged)

S5 customer-data DR drill; G12 parity-on-real-drift + PBS-tier runtime; CGNAT retest; Impl-3; OOB spike. Next: GL-7 (Peti's day-0 runbook + tester agreement).