felhom.eu/REPORT.md

REPORT — installer golden gate + golden 0.211.0 bake (2026-08-10)

Commits eb60087 (R-297 installer) and 999b0a3 (bake evidence). CI run 299 → success. All eight repo_gates.py gates OK, including golden-currency, which this run took from RED to GREEN. --no-verify was not used at any point — the currency gate refused an earlier push and that refusal was respected until the bake made it true.

R-297 — an install takes the golden you approved

felhom-host-install.sh v1.26.0. Step 7 short-circuited on ANY local archive: no version compare, no digest, no warning, so the manifest's sha256 — which vouches from a different trust root than the code host — was consulted only on the fetch path. Discovery is sort | tail -1: correct by recency, never by verification.

golden_local_matches_manifest() compares digest first (a match means it IS the vouched artifact), then the controller tag baked at /etc/felhom-controller-image. Auto-discovered mismatch → ignore and fetch the vouched one; operator-named (--golden) mismatch → REFUSE, never silently substitute; unreadable manifest → refuse rather than pass.

Measured on real hardware: three goldens sit on demo-hp carrying controller 0.153.0 and 0.210.0, and nothing compared either to the vouched version before use.

NOT PUBLISHED. The task asked that a fresh install be watched taking a stale local golden on drill-r50 BEFORE the fix. That was not done, so installer-v1.26.0 is deliberately not cut and webpage.yaml is untouched — pushing to main publishes nothing (R-110). Publishing an unobserved change to the one artifact that runs as root on a virgin box is the failure this project keeps writing rules about.

Golden 0.211.0 — baked, published, round-trip verified

Full evidence: documentation/tests/golden-0.211.0-2026-08-10/ (bake.log + RESULT.md).

• GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849
• Served bytes re-downloaded and hashed → identical. 656 141 689 B.
• All six acceptance markers counted (two initially returned a false 0 through broken shell quoting and were re-run with grep -F — a 0 from a broken instrument is not a measurement).
• Token never on a command line; leak grep on the committed log = 0, and that 0 was made believable by first proving the grep finds a planted token.
• Drill VM reverted to virgin before and after; build guest destroyed --purge; /root residue empty.

Registers

R-295 (PARTIAL — hub half open), R-296, R-297, R-298 filed. Ceiling moved R-294 → R-298.

NOT DONE

• The Day-0 vouch — the operator's, deliberately not made here.
• Part 2 (uninstall leaves dnsmasq bound to :53) — dropped first, per the task's drop order.
• Part 4a (hub half of the code naming, and its emails) — dropped second, filed as R-295 PARTIAL.