admin
78d16b37a1
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
57 lines
3.6 KiB
Markdown
57 lines
3.6 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## Hub v0.46.0 — observability pass: per-box log pulls, bundle custody, TTL + secret gate — 2026-07-11
|
|
|
|
felhom.eu's third of the cross-repo observability task (agent v0.83.0 + controller v0.116.1 shipped
|
|
in their repos). Commits: hub `e35b1ae`, manifest bump + conventions runbook `7c038df`.
|
|
**Deployed:** `felhom-hub:0.46.0`, ArgoCD `Synced/Healthy`, rollout complete (17:03 CEST).
|
|
|
|
### What shipped
|
|
|
|
- **Store** (`hub/internal/store/logbundle.go` + schema): `log_bundle_requests` (pending intent per
|
|
scope+component — controller scope = customer_id / report ACK; agent scope = host_id / heartbeat
|
|
envelope) + `log_bundles` (gzip, newest-3, **72 h TTL** purged on the existing 60 s sweep).
|
|
`SaveLogBundle` runs the **token-pattern secret gate BEFORE storing**: a hit stores a
|
|
`blocked: possible secret` flag row and NO payload (fail-closed, WARN hub-side); `[REDACTED]`
|
|
shapes + public checksums pass by design.
|
|
- **Channels** (additive both directions): report ACK `controller_log_requested` + ingest of
|
|
`controller_log_tail`; heartbeat envelope `log_tail_requested` + ingest of `log_tail`.
|
|
Consume-once on arrival. A pre-0.83 agent never fulfills → the request stays visibly `pending`
|
|
(S6-tested, harmless).
|
|
- **UI** (host detail, English per the hub operator surface): Diagnostics section — "Request
|
|
controller logs" / "Request agent logs" (CSRF forms), state rows (`pending` with the honest
|
|
latency hint: controller ≤ ~15 min report interval, agent ≈ heartbeat cadence; `available` with
|
|
View/Download; `blocked`), 72 h custody note. The hosts "read-only" invariant is amended by test:
|
|
these two forms are the ONLY actions.
|
|
- **Conventions codified:** `documentation/runbooks/logging-conventions.md` (levels, logs-are-
|
|
English, keys-never-values, capture layers, pull posture) + a one-liner in each repo CLAUDE.md.
|
|
|
|
### Red-proofs (demonstrated, restored)
|
|
|
|
| Scenario | Reverted shape | Failure seen |
|
|
|---|---|---|
|
|
| S4 secret gate | gate disabled | `secret-shaped token not blocked` |
|
|
| S2/consume-once | clear-on-arrival removed | `request survived fulfillment` (store + API tests) |
|
|
|
|
S5 TTL: injectable clock — kept at +71 h, purged at +73 h. Keep-newest-3 + byte-cap belts tested.
|
|
|
|
### Live evidence / honest latencies
|
|
|
|
- Hub 0.46.0 live (ArgoCD Synced/Healthy, image verified, clean startup log).
|
|
- Box halves live-proven from 9201: controller ring + agent ring both readable at
|
|
`logging.level=info` through the new Debug tabs (see felhom-controller/REPORT.md timestamps).
|
|
- **Operator follow-up (HUMAN — hub UI is password-gated, CC cannot log in):** on
|
|
`hub.felhom.eu/hosts/<demo host>` click both request buttons; expect the agent bundle within one
|
|
heartbeat (~15 min) and the controller bundle on the next report (≤ ~15 min); download both and
|
|
confirm the controller bundle carries the NAS-add phase lines + the `operator log pull served`
|
|
INFO line. The full round-trip is already proven by `internal/api/logbundle_ack_test.go`.
|
|
- Blocked-secret branch: test-level only by design (no real secret planted live).
|
|
|
|
### Open / observations
|
|
|
|
- Hub bearer key rotation still DUE (pre-existing; manifests/hub.yaml + screenshot-exposed).
|
|
- `log_bundles` UI states `requested → pending` are merged (a request IS pending from the box's
|
|
view); `expired` renders as absence after the purge — states documented in the template hint.
|