admin
38848ffbeb
gates / gates (push) Successful in 21s
Golden 0.242.0 baked, round-trip verified and vouched (cadence rule, R-468). Fresh box from the public ISO on demo-hp: landed on the vouched set, two apps deployed and used, backup, remove, byte-identical restore, power cut and code typo all PASS. Stopped for a volunteer by R-493 (no instructions) and R-494 (the setup mail's dashboard link has no DNS; intervention I1). R-493..R-500 filed. Capability map: first-hour row added (PARTIAL), journey row scoped. Stopgap Hungarian volunteer guide written. Hub teardown layer pending. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
110 lines
6.7 KiB
Markdown
110 lines
6.7 KiB
Markdown
# REPORT — DRILL: a stranger's first hour on 0.242.0 (2026-09-14)
|
|
|
|
**Runbook-style validation. No product code written.** A parallel session owns root `REPORT.md`, so
|
|
this is a topic sibling (`CLAUDE.md`). Findings doc: `documentation/audits/DRILL-fresh-install-0242-2026-09-14.md`;
|
|
every observable: `documentation/audits/evidence-drill-fresh-install-0242-2026-09-14/journal.md`.
|
|
|
|
## 0. Claims in the brief that turned out wrong, or incomplete — named first
|
|
|
|
1. **"ep0 is not touched."** Enrolment itself registers a WireGuard peer on ep0 for every box
|
|
(`wg registered … ip=10.77.0.5/32 … sync=ok`), DR tier on or off. I avoided the part I could (DR
|
|
tier off, which would have created an ep0 namespace and token); the peer is the product's own act
|
|
and is removed by the host delete (§5).
|
|
2. **"This run re-proves or narrows the journey row (~L90)."** That row is the **rebuild-and-recover**
|
|
journey (walk 5). This drill walked the **first hour**, with off-site off. It can neither re-prove
|
|
nor narrow that row. I added a scope note to it and a **new first-hour row** (PARTIAL).
|
|
3. **"Claim the box with the code."** There are three secrets, not one: the console **Párosító kód**,
|
|
the operator-held **Tulajdonosi jelmondat** (nothing delivers it — R-497) and the mailed
|
|
**Beállító kód**. Two of the three arrive by mail, which this harness cannot read.
|
|
4. **The three claims marked "read, not measured"** — measured now: **website** — true, no mention of
|
|
the installer or `iso.felhom.eu`, and the ISO host has no index; **instructions** — true, none exist
|
|
(R-493); **golden landing** — the box landed on 0.242.0, the new golden, with no self-update.
|
|
5. **"Newest baked golden 0.236.0; waiver to 2026-09-27; highest R-492; baselines"** — all correct.
|
|
|
|
## 1. Baselines (re-verified 12:58 UTC)
|
|
|
|
controller `406755fa8fba` v0.242.0 · agent `4586f0f7f6d1` v0.130.0 · felhom.eu `41590f8ee618`
|
|
hub v0.112.0. Hub before: agent 0.130.0, golden 0.236.0, `min_agent` 0.129.0, floor 0.242.0.
|
|
Architecture read for the area: `00-capability-map.md` (journey row), `09-update-architecture.md` §3.
|
|
|
|
## 2. The golden
|
|
|
|
**0.242.0 baked, round-trip verified, vouched** — sha `3ab480dd…e6d8`, 653 288 425 B, all markers
|
|
pass, token-leak 0 with a working control, three readers agree. Only `golden_version` moved.
|
|
`documentation/tests/golden-0.242.0-2026-09-14/README.md`. The golden-currency gate is now plain OK.
|
|
One slip: my first template pick was arm64; caught before the bake.
|
|
|
|
## 3. The verdict
|
|
|
|
**Interventions: 1.** **Ready for a volunteer: no** — no instructions exist (R-493), and the setup
|
|
mail's dashboard link does not open for a new customer (R-494). Every mechanism after that passed:
|
|
install, landing on the vouched set, deploy, use, backup, remove, **byte-identical restore**, power cut
|
|
(same versions, no alarm), code typo and lockout.
|
|
|
|
| intervention | row | what |
|
|
|---|---|---|
|
|
| **I1** | R-494 (filed before acting) | dashboard reached by LAN address with the name forced — the mailed name has no DNS |
|
|
|
|
Harness substitutions (a volunteer would not need them; each hides a part of the path): **H1** no
|
|
mailbox → operator bind instead of the self-bind page, and two box-printed setup codes via the vaulted
|
|
break-glass; **H2** US keyboard layout; **H3** auto-reboot unticked, ISO detached; **H4** Terminal UI
|
|
entry. Full list with harness slips: findings doc §3.
|
|
|
|
## 4. Findings — every one a row
|
|
|
|
| row | rank | |
|
|
|---|---|---|
|
|
| R-493 | P1 | no customer install instructions; ISO host has no index |
|
|
| R-494 | P1 | new customer's dashboard has no address (I1) |
|
|
| R-495 | P2 | installer's unanswered questions; refuses its own default hostname |
|
|
| R-496 | P2 | console sends a stranger to the Proxmox admin page; „a jelszavadat" |
|
|
| R-497 | P2 | the Tulajdonosi jelmondat is delivered by nothing |
|
|
| R-499 | P2 | „already in the PBS backup, nothing to do" on a box with no PBS |
|
|
| R-498 | P3 | 52 of 53 app pages say literal `wiki.DOMAIN` |
|
|
| R-500 | P3 | dashboard backup time in UTC, backup pages in local time |
|
|
|
|
**R-469 was not touched.** R-214 reproduced (recorded, row unchanged).
|
|
**Register: 200 → 208 table rows. Opened 8, closed 0.**
|
|
|
|
## 5. Teardown — three layers
|
|
|
|
| layer | before | after |
|
|
|---|---|---|
|
|
| **1. machine** | `qm list`: VM 330 running, 8.6 G in `/mnt/hdd_1/images/330` | `qm destroy 330 --purge` → `qm list` empty; `images/330` gone; `images/9202` untouched |
|
|
| **2. host** | `nvme-scratch` used 19 059 372 KiB · `local` used 24 768 200 KiB · ISO present · `/root/drill0242` 40 files | `nvme-scratch` **10 130 532 KiB** (≈8.5 GiB returned) · `local` **23 013 832 KiB** (the 1.7 GiB ISO) · ISO 0 · scratch dir shredded and removed. `nvme-scratch` storage itself stays — it hosts 9202. `vmbr9` pre-existed |
|
|
| **3. hub** | customer `drill0242`, host `drill0242-3f4b42` ONLINE, `deletable:false`, `wg_peer_bound:true`, `recovery_present:true` | **PENDING — see §5b** |
|
|
|
|
### 5b. The hub record
|
|
|
|
*(Filled in when the host has aged to stale and the delete cascade has run.)*
|
|
|
|
**Append-only and staying, by design:** the hub's event stream (`controller_started`, `app_removed`,
|
|
`claim_lockout`, the bind and enrol lines) and the operator e-mail for the lockout.
|
|
|
|
**Untouched, and checked:** demo-hp guests 9201 and 9202 (running before and after); `local-lvm`
|
|
(44.17 % before and after); demo-felhom; DooPlex services (the bake VM, the accepted exception, back
|
|
on `virgin`); Peti's box; ep0 beyond the product's own peer. `drill-r50` does not exist (R-461).
|
|
|
|
## 6. Secrets
|
|
|
|
Hub password, BookStack and dashboard passwords, the passphrase, both setup codes, the break-glass
|
|
credential and the installer root password lived only in `0600` files in the session scratchpad.
|
|
**Every committed file was swept for each, with a planted control that was found: 0 hits.** The
|
|
pairing code is redacted in two screenshots and the text. The break-glass reveal emitted its audit
|
|
event, by design.
|
|
|
|
## 7. `unproven.py --summary`
|
|
|
|
Unchanged: 55 claims, NOT WALKED 35 of 55. It reads its own claim list, not the new map row.
|
|
|
|
## 8. Observations
|
|
|
|
- The deploy page's poll has no `degraded` branch; 16 s of stale step text on BookStack.
|
|
- The drive-attach list offers the guest's own system volume as an existing drive.
|
|
- The removal dialog names „éjszakai restic pillanatképek" on a box with no restic.
|
|
- „0 °C" beside „Nincs adat" for a virtual disk; an English „Debug" menu item.
|
|
- The claim lockout is global as well as per source; its mail reaches the operator only.
|
|
- Two of my first readings were of script-rendered elements from server HTML (host-metrics banner,
|
|
restore-finish message); both corrected in the journal. **No browser here — strict UI coverage is
|
|
the operator's click-through.**
|