admin
3e949bc513
Audit doc for the Day-0 VM drill: appliance install, floor-at-first-report, escrow ceremony + auto-confirm FIRST LIVE FIRING (~7.5 min, zero clicks), offsite backup + restore round-trip, PBS-DR/WG fork (Peti-sequence rehearsal). Corrects day0-install.md A.2 (git creds optional since v1.11.2, anonymous fetch is the normal shape) and RUNBOOK-escrow-ceremony.md (identity-only mode does NOT exist — F-6; age prereq — F-10). REPORT.md overwritten; CONTEXT.md one-liner added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN
2.7 KiB
2.7 KiB
felhom.eu — task reports
Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.
DRILL — Day-0 on the Demo-VM (nested PVE) + escrow/auto-confirm first firing — 2026-07-12
Full report: documentation/audits/DRILL-day0-vm-2026-07-12.md. Supervised drill (Viktor + CC), ~15:15–17:09 CEST, on a throwaway nested PVE 9.2.2 VM (qm 300 on felhom-pve) against hub customer demo-vm-felhom / enkisfelhom.hu. No code changes; two runbook docs corrected (day0-install.md A.2 anonymous-fetch wording; RUNBOOK-escrow-ceremony.md's false "identity-only ≥0.80.0" claim + age prereq).
Headlines
- The whole arc ran to completion on a fresh box: appliance-mode Day-0 (agent 0.85.0 + golden 0.120.0, both sha-verified, "Day-0 provision SUCCESS"), guest at floor 0.120.0 at FIRST report with zero manual steps, ActualBudget deployed through the tunnel, escrow ceremony sealed (R with Viktor only), AUTO-CONFIRM FIRST LIVE FIRING: pending → escrowed in ~7.5 min with zero clicks, offsite backup (1 snapshot, 14 s) and the verification-restore round-trip proven (48K payload decrypted back from the Storage Box).
- F-4 (HIGH): G10 is unclosable — no operator-set dashboard password path exists in shipped code (hub has no per-customer
password_hashUI/API; controller's open-state page defers to the operator; Day-0 preseeded setup skips the wizard's password form). Every fresh box's dashboard stays OPEN on the internet. Blocks the tester onboarding gate. - F-6 (HIGH): identity-only escrow ceremony was never implemented — on a no-PBS box (the documented appliance standard) the offsite escrow chain can never complete. Mid-drill fork (Viktor): attached the PBS DR tier (ep0) instead, which live-rehearsed Peti's exact pending sequence — wrapper+
ageprep →wg_tunnel.enabled→ hands-free WG peer registration → hub PBS-DR enable (WG-first dependency guard works) → apply-bridge fresh path (consume-once → K born → escrow seed) → ceremony → auto-confirm. - Fresh-box installer gaps found live:
felhom-pbs-applybinary not shipped (F-7),agenot installed (F-10), root-ownedguests/parents break the non-root agent's lanresolver (F-3, live-fixed; demo host likely has the same latent state), silent root@pam rotation surprises the operator (F-8), version strings disagree ×3 (F-1). - Snapshots on qm 300 for re-drills:
pre-day0-clean/post-install/post-drill. Demo 9201, Peti's hub entry, demo offbox untouched.