felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK GL-8 — BYO coexistence hardening (host-install v1.12.0) — 2026-07-08

Baseline confirmed: felhom.eu 1dc86523, SCRIPT_VERSION="1.11.3" → 1.12.0 (18a556a5). Three independent fixes from the GL-6 drill findings, one file, one theme (BYO = Felhom is a guest on a host it doesn't own). felhom.eu only; agent untouched. §13 STOP honored — no live install/ uninstall; the F6 refuse path is a read-only preflight die (safe to exercise), proven on felhom-pve.

The three fixes

• F3 — leaf guard narrowed. The populated-host leaf-regeneration guard tested pct list (ANY guest) and so over-fired on a BYO host's own non-Felhom guests, forcing --allow-new-leaf on every fresh byo install. Now it tests [[ -n "$(felhom_guests)" ]] (the /etc/felhom-bootstrap detector) — it fires only when a real Felhom guest exists (whose pinned fingerprint a leaf regen would orphan — the 2026-06-28 incident). --preserve-state-from / --allow-new-leaf unchanged.
• F6 — foreign :53 refuse (byo), Viktor's §8 option 1. In byo the agent's lan_resolver stays off, so any :53 bind is the owner's. GL-2's informational :53 line is promoted to an actionable gate that dies with remediation and mutates nothing — Felhom does not stop/mask/kill a DNS service on a host it doesn't own (the break-glass analog). No stop/mask path, no consent-ack leg (nothing to consent to). ss failure/absence degrades to a warn. Appliance mode untouched.
• F1 — uninstall config purge. The teardown removed agent.json but left ${agent_cfg}.bak* siblings — a GL-6 residue held a live hub api_key. Now it removes the config AND every .bak* sibling, then the dir; the KEPT/WIPED statement + summary say "config (+ its .bak backups)". Paths logged, contents never. GL-4 Scenario-D parity still green (the GL4-D token set unchanged — the config removal was already covered).

Tests (harness hostinstall-mode-harness.sh, extended)

Static (anywhere): GL8-F3 (guard uses felhom_guests, not pct list), GL8-F6 (byo :53 gate refuses+instructs; no systemctl stop/mask / kill of any :53/dnsmasq/resolv service anywhere), GL8-F1 (${agent_cfg}.bak* removal present) + GL8-F1b (behavioural: the exact glob-removal clears agent.json + three .bak* + the emptied dir). PVE tier on felhom-pve: GL8-F6 live — the byo preflight actually refused at :53 (felhom-pve's leftover dnsmasq is bound — the exact GL-6 F6 scenario) with the remediation + PRE-FLIGHT FAIL (exit 1); and the free-:53 arm (ss shimmed empty) passes the gate. 36/36 on felhom-pve, 0 failed; shellcheck clean; GL-2 Scenario-A + GL-4 Scenario-D regression green.

Red-proofs (mutate scratch copy → invariant fails → discard): RP-F3 (revert to pct list) → GL8-F3 FAILS; RP-F6 (drop the :53 die) → GL8-F6 FAILS; RP-F1 (narrow to agent.json only) → GL8-F1 FAILS. All confirmed.

Judgment calls

• F3 behavioural runtime is impractical to isolate (the guard is inline in step 5, gated on the real state dir's leaf; felhom-pve has BOTH a leaf and a Felhom guest) — validated grep-level + red-proof; the true behavioural proof (fresh byo install on a populated non-Felhom host proceeds without --allow-new-leaf) folds into GL-7's Peti install.
• F6 uses the existing ss -H -ltnup (UDP+TCP) invocation — catches a UDP-only resolver (dnsmasq) too, not just TCP.
• F1 is surgical (${agent_cfg} + ${agent_cfg}.bak*, then rmdir), not rm -rf the dir — respects a non-default -config path that might share a directory.

NOT live-validated (folds into GL-7 / a demo re-run)

The real populated-host byo install proceeding without --allow-new-leaf (F3); the real foreign-:53 refusal on Peti's box (F6 — proven read-only on felhom-pve here); the real uninstall purging a .bak (F1 — behaviourally unit-tested + grep-verified). All fold into GL-7's Peti day-0 as the live proof.

Findings status + what's next

F1/F3/F6 → FIXED (v1.12.0) in the GL-6 ledger + GO-LIVE-PACKAGE. Still open (non-blocking): F2 (per-drive mnt-*.mount units survive uninstall), F7 (pool re-assert bring-up-only, no continuous heal — --adopt-pool repairs). GL-7 is unblocked — Peti's day-0 command needs no --allow-new-leaf workaround. Next: GL-7 (Peti day-0 runbook + tester agreement).