78 lines
5.1 KiB
Markdown
78 lines
5.1 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
# TASK-B — R-39 fleet fix + R-50b(a) · hub **v0.67.0 → v0.68.0**
|
|
|
|
**Date:** 2026-07-21 · **Baseline:** `c35da9d` (clean, == `origin/main`) → `54a4644`.
|
|
Companion: agent **v0.91.2** (`felhom-agent`, see that repo's `REPORT.md` for the agent half,
|
|
STOP-1 evidence and the four red-proofs).
|
|
|
|
## Status
|
|
|
|
| Leg | Status |
|
|
|---|---|
|
|
| Hub v0.68.0 | **SHIPPED + DEPLOYED** — GitOps manifest bump `0.67.0→0.68.0`, ArgoCD `Synced/Healthy`, rollout complete, pod 1/1 |
|
|
| Agent v0.91.2 | shipped + published + deployed to felhom-pve |
|
|
| STOP-1 | done + verified |
|
|
| **STOP-2 / STOP-3** | **BLOCKED — need the operator.** I cannot authenticate to the hub UI (login → HTTP 401); the password is a bcrypt hash I do not hold, by design. |
|
|
|
|
## What shipped hub-side
|
|
|
|
- **`host_pbs_secrets.generation`** — a monotonic per-host counter advanced by every fresh MINT and
|
|
by nothing else, stamped into the descriptor as `secret_generation`. Since the agent re-applies on
|
|
the descriptor's CONTENT HASH and a re-key returns byte-identical `token_id` / `fingerprint` /
|
|
`datastore` / `namespace`, this is the only field that moves — and therefore the thing that
|
|
re-arms a converged agent.
|
|
- A **re-stage** deliberately does not advance it (same secret, unchanged descriptor content).
|
|
- `omitempty` is load-bearing: emitting a zero would shift every pre-existing descriptor's hash at
|
|
once — a fleet-wide spurious re-apply.
|
|
- **Deviation from spec, deliberate:** the brief said to reuse "the new row's id … no schema
|
|
change". There is no row id — the table is `host_id PRIMARY KEY`, UPSERTed last-write-wins — and
|
|
`created_at` collides for two mints in one second. An additive counter column (existing
|
|
idempotent `ALTER TABLE` idiom) is the only monotonic source. **Verified applied on the live DB
|
|
after deploy.**
|
|
- **`pbsdrheal` gains an `auth_failed` trigger** — a new trigger in the existing machine, escalating
|
|
to a fresh mint (never a re-stage, which would re-feed the secret PBS just rejected) through the
|
|
**existing damper**, so a 401 flap cannot become a secret-minting chain.
|
|
- **`consumed_at` honesty gauge** — an unconsumed secret past a 15-minute grace under a box reporting
|
|
`applied` is the exact 2026-07-18 fingerprint and a disagreement **no single tier can detect
|
|
alone**. Surfaced with its own event, deliberately as a SURFACE not a heal: auto-re-issuing would
|
|
mint a second secret on top of an unconsumed one, which is the mint/consume race R-39(a) recorded.
|
|
- **Corrected a comment that stated a falsehood** — `ReissuePBSDR` claimed it refreshed the
|
|
descriptor "with the NEW token_id/fingerprint". False for a re-key, and believing it is why nobody
|
|
expected the descriptor to come back identical.
|
|
- **R-50b(a)** — `ArtifactManifest.WrapperSHA256` + operator field + host-page drift surface. **An
|
|
unknown on either side reads as quiet, never as drift.**
|
|
|
|
## Method notes worth keeping
|
|
|
|
- **P2 confirmed GitOps-only, and the trap is real:** `build.sh` itself prints
|
|
`kubectl set image …` as its deploy hint, contradicting `CLAUDE.md`. Not used. Worth fixing in the
|
|
script — it will mislead exactly the session that trusts tool output over the runbook.
|
|
- **P4 read the fleet from a temporary copy of the hub DB**, which carries live credentials
|
|
(`api_key`, `host_pbs_secrets.value`). Copy shredded immediately after each read. Result: **one
|
|
enrolled host**, so the MinAgent raise strands nobody.
|
|
- Tests include a **flow-level** `ReissuePBSDR` test against a fake that models a real re-key
|
|
(identical token/fingerprint, rotated secret only). Its red-proof fails on the assertion with both
|
|
byte-identical blocks printed — the July-18 defect reproduced in a unit test.
|
|
|
|
## For the operator
|
|
|
|
**STOP-2 (one click):** press **Re-issue PBS credentials** for the demo customer. Expected:
|
|
fresh secret row → `secret_generation` **0 → 1** (the live descriptor has no such key today) → poke →
|
|
agent re-applies with **no short-circuit** → fresh secret consumed → reconcile rc-0 → probe 200 → tier
|
|
`active`. The July-18 negative — the same click doing nothing — is the historical red-proof.
|
|
|
|
**STOP-3 (manifest save):** Agent `0.91.2` / sha256 `34d309be429473f3f0ab34e3185e17b22463a341b30bf46e162306bff4aec22a` /
|
|
**PBS wrapper sha256** `104db0a4401f65bbc476e82bfb1796433bcb36f8f8cce69efb3bb5c40fcb16b3` /
|
|
MinAgent `0.91.2`. Superseded, do not vouch: 0.91.0 (inert probe leg), 0.91.1. `0.90.1` correctly
|
|
stays 404.
|
|
|
|
## Residual
|
|
|
|
R-50b **(b)/(c) remain open** — the wrapper is still fetched unversioned from `raw/branch/main`; this
|
|
release makes drift visible, it does not fix the channel. The 0440 sudoers file is not agent-readable,
|
|
so its drift stays invisible. The DR-tier capability-map row is deliberately **not** upgraded to
|
|
PROVEN-LIVE until STOP-2 supplies the evidence.
|