27 KiB
GO-LIVE PACKAGE — first external tester (Peti)
Tracking doc for the pilot go-live: gating items, statuses, decisions, task sequence. Lives at
felhom.eu/documentation/pilot/GO-LIVE-PACKAGE.md. Update per task completion. Created 2026-07-07 (project-Claude, source-verified). Operator: Viktor.
Baselines at creation (verified live): agent ced60dd/v0.74.0 · controller 59eb3bea/v0.103.0 ·
catalog 2ebe082a · felhom.eu 1a1e42ad/hub v0.35.0 · host-install v1.9.1 · golden 0.98.3.
Updated 2026-07-07 (GL-2 shipped): felhom.eu 02d63ed0 · host-install v1.10.0 + scripts/hostinstall-mode-harness.sh.
Updated 2026-07-08 (GL-4 + GL-5 shipped): felhom.eu f7cc6a72 · host-install v1.11.0 (uninstall gap-closure + key-pin plumbing) · felhom-agent v0.75.0 (DR bind overrides, live on felhom-pve).
Updated 2026-07-08 (GL-5b shipped): felhom-agent v0.76.0 live + PUBLISHED (9828c5f7…f50b) — restore-test full-fidelity + mount parity (new G12); the manifest bump target is now 0.76.0.
Updated 2026-07-08 (GL-8): felhom.eu 18a556a5 · host-install v1.12.0 — BYO coexistence: F3 (leaf guard narrowed to Felhom guests → no --allow-new-leaf on a populated BYO host), F6 (byo refuses a foreign :53, never mutates), F1 (uninstall purges config .bak*). F6 live-proven on felhom-pve; harness 36/36. GL-7 unblocked (Peti's command needs no workaround).
Updated 2026-07-08 (GL-6 DRILL COMPLETE): felhom.eu 87ba30ae · host-install v1.11.3 (F4 resume fix shipped mid-drill; v1.11.2 anon-fetch ruling). Two full destroy/rebuild cycles on felhom-pve; manifest confirmed vouching agent 0.76.0 + golden 0.103.0. G2/G4/G5/G6/G7 LIVE-VALIDATED; G1 DONE; key-pin legs 1–4 proven. Record: DRILL-GL6-2026-07-08.md.
Updated 2026-07-09 (GL-7 SHIPPED): felhom.eu 844fbfa7 · hub v0.36.0 LIVE (ArgoCD synced/healthy) — operator customer page now (a) MASKS the retrieval passphrase (reveal/copy, never baked into a copyable command) and (b) carries an interactive install-command generator (vanilla JS, real v1.12.0 flags only, download-then-run, JS-off static fallback). Tester agreement written (PETI-tester-agreement.md). G9/G10/G11 closed to their pilot-ready state (G9/G11 = onboarding-time actions, documented). GL-7 DONE.
1. Pilot definition & locked decisions (2026-07-07)
| # | Fork | Decision |
|---|---|---|
| D1 | Pool model | One shared felhom pool. No multi-tenant boxes yet; the pool separates Felhom guests from the host owner's own workloads. Effort goes to preflight pool-membership assertion + local-API per-guest token scoping (verified structural, see G10). |
| D2 | Pilot topology | BYO host. Peti installs Felhom onto his OWN Proxmox server, already running his own LXCs. This reframes containment: not customer-vs-customer, but Felhom-as-a-guest on a host the operator does not own. See §2. |
| D3 | Backup posture | Local-only for the pilot. wg_tunnel.enabled and oob.enabled stay FALSE. Offsite (Tier-1/Tier-2 split + production WG endpoint) is a fast-follow, and the limitation is stated honestly in the tester agreement. |
| D4 | Uninstall drill | Full provision → uninstall → re-provision drill on the demo box BEFORE Peti's day-0. Peti's box is never the first live test of anything destructive. |
| D5 | DR bind-override | Fix now (small, spike-validated known-constant override per SPIKE-dr-bindmount-source-2026-07-07.md), not deferred to the intermediary-mount re-architecture. |
| D6 | Packaging | This one tracking doc + a sequenced set of CC tasks (GL-1…GL-7). |
2. The trust-model reframe (BYO host) — load-bearing
Everything so far was designed for the appliance model: Felhom-owned hardware, Viktor is the root-holding operator, the customer is a UI user. Peti's pilot is the BYO-host model: Peti is root on his own PVE box; Felhom is a guest system there (one LXC + a non-root agent + narrow sudoers + a pool-scoped token). Consequences, each source-verified:
- Break-glass inverts.
step_break_glass(host-install.sh:1186, step 4b/8, NOT flag-gated) sets root@pam viachpasswdand vaults it to the hub. Right for appliances; on a BYO host it silently changes the owner's root password and hands the operator root on hardware he doesn't own — a consent, trust, and data-sovereignty violation. Must be profile-gated (G2). - Host-wide artifacts need coexistence review, not just installation: dnsmasq snippets under
/etc/dnsmasq.d/felhom-*.conf+systemctl restart dnsmasq(and the installer installs the dnsmasq package) can collide with the owner's existing DNS; the mgmt watchdog + tmpfiles heal/run/sshdon his sshd (additive, likely benign — verify); felhom-sshd/OOB stays off (D3). - Already good citizens (verified): VMID selection collision-safe (default 9201, auto-next-free
over the union of
pct+qmids, explicit--vmiddies unless--force— host-install.sh:223–241); uninstall targets only guests carrying the/etc/felhom-bootstrapbind mount and refuses non-Felhom guests (:337, :472); stale-lock reaper is pool-intersected (agent v0.62.0); local-API requests are authorized strictly against the caller-token's own guest (localapi/server.go:23, :53–55, :153). - Local-API exposure: binds the vmbr0 IP:8443 by default (host-install.sh:1546–1548) — on a BYO host that's reachable from the owner's LAN and his other guests. Defense = TLS + per-guest bearer token. Acceptable for the pilot; documented in G10.
3. Gating items (must be green before Peti's day-0)
Status legend: ✔ DONE · ◐ PARTIAL · ○ OPEN · ⚠ BLOCKER
| ID | Item | Status | Evidence / gap |
|---|---|---|---|
| G1 | Publish + vouch chain current & self-update alive. ARTIFACTS PUBLISHED (RUNBOOK GL-1, felhom.eu a63cc715): agent 0.74.0 sha 1ec3f588…76af05 (the exact live-proven felhom-pve bytes, hash independently re-verified anonymously) and golden 0.103.0 sha 8481e8a1…6026e (clean-room bake on the virgin drill VM, controller 0.103.0 baked, both split volumes in the vzdump). Key-pin day-0 PLUMBING SHIPPED in GL-4 (v1.11.0: OPERATOR_KEY_* constants empty-by-default + --operator-pubkey-file → authz.signers; preserved-signers never clobbered; verify reports armed/dormant). DONE (GL-6): hub Day-0 manifest confirmed vouching agent 0.76.0 + golden 0.103.0 (fetched via the box API at Phase 0); the key CEREMONY is complete (real op/rec keys pinned in v1.11.1, fingerprints box==repo==manager, ARMED from first boot); and the pinned operational key authorized a real signed agent_update round-trip end-to-end (0.76.0→0.76.1→0.76.0). Published chain consumed live via anonymous fetch (v1.11.2 ruling). |
✔ | DRILL-GL6-2026-07-08.md §Phase 3; RUNBOOK-GL1 |
| G2 | BYO-host install profile. SHIPPED as --mode appliance|byo (mandatory, no default; the flag was repurposed from the retired provision|dr — dr stub seam preserved). byo: break-glass gated OFF at its single call site (:2040–2044 — root@pam never touched, nothing vaulted), caps mandatory, --enable-oob/--rotate-recovery refused, host-mutation disclosure + typed-hostname ack, post-write config asserts (lan_resolver/wg_tunnel/oob must be off — asserts run BEFORE _state_mark agent_config, so --resume re-asserts). Red-proofs RP-1..3 run→fail→revert. Appliance flow unchanged. LIVE-VALIDATED (GL-6): byo install on real hardware — disclosure printed, Viktor typed the hostname ack, NO 4b/chpasswd/vault, config asserts held, signers armed. |
✔ | DRILL-GL6 §Phase 2 |
| G3 | git.token scope-down + rotate — UNBLOCKED, and now coupled to a visibility ruling. Gate 3c (GL-1): both generic packages are anonymously world-readable, so rotating the customer token to read-only cannot break fresh-install fetches; the empty-creds die on demo-felhom is the installer's resolve_git_creds precondition (:326–332), not a Gitea requirement. NEW FINDING (project-Claude probe, 2026-07-08): the ENTIRE Gitea instance is anonymously readable — all nine repos private=False, including homelab-manifests (k3s manifests — audit for raw Secret objects) and personal repos (work, revfulop-calendar). Only the geo-fence (HU/DE/US) limits reach. Coupling warning: if the reaction is to lock the instance ("require sign-in"), the anonymous day-0 package fetch dies and read-scoped tokens become MANDATORY — retest the fetch path with a token before any visibility change. |
○ ⚠ | GL-1 record §Gate 3c; anonymous repos/search probe 2026-07-08 |
| G4 | Preflight guards (refuse-to-provision gate). SHIPPED in v1.10.0: byo dies on non-9.x PVE (unless --force) and on missing --acl-storages entries (named); :53 DNS info line + existing-guest count; --preflight-only runs the full mode-aware checks with a PASS/FAIL verdict and zero state marks (live-proven on felhom-pve, incl. the FAIL verdict on a bogus storage). Verify asserts pool membership + all scoped-ACL grants in BOTH modes. LIVE-VALIDATED (GL-6): C7 fired — an induced pool-membership drop made step_verify log_error + WITH-WARNINGS, read-only; --preflight-only also proven live. |
✔ | DRILL-GL6 §Phase 4 (C7) |
| G5 | LXC caps mandatory on BYO hosts. SHIPPED: byo refuses to run without explicit --cores AND --memory (:947, fires before the passphrase prompt); existing cap-sanity warns retained. Appliance unchanged (optional). LIVE-VALIDATED (GL-6): byo install ran with --cores 4 --memory 8192 (Viktor's N100 values); the guest's pct config shows cores 4 / memory 8192. |
✔ | DRILL-GL6 §Phase 2 |
| G6 | Uninstaller gap-closure (customer offboarding). SHIPPED in host-install v1.11.0 (GL-4, f7cc6a72): 4b4 self-update-artifact removal (wrapper, .prev/.new.* slots, rollback unit, limits drop-in — derived from the guarded script itself), per-drive unmounts under /mnt/felhom-drives (plain umount ONLY, busy = warn+guidance, root-bind guarded), the KEPT-vs-WIPED statement in BOTH modes (drives/PBS/hub record/escrow/vaulted recovery credential named as living on), guest-only drive note from the bind store. LIVE-VALIDATED (GL-6): two real uninstalls — busy-drive prop handled (warn+guidance, no -l/-f, statement=retry), KEPT/WIPED statement verbatim, host audit clean, drive data intact ×3 (witness hash matched every time). Findings F1 (config .bak residue) + F2 (mount-unit residue) filed. |
✔ | DRILL-GL6 §Phase 1/5 |
| G7 | Demo-box drill — DONE 2026-07-08. Two full destroy/rebuild cycles (byo + appliance) + two uninstalls on felhom-pve, Viktor gating every phase; F4 found+fixed+proven mid-drill (v1.11.3), C7 + armed-key chain live-validated, data intact ×3. | ✔ | DRILL-GL6-2026-07-08.md |
| G8 | DR bring-up bind-override fix (agent). SHIPPED as v0.75.0 (GL-5, b3446213, LIVE on felhom-pve) + scratch-DR live-validated end-to-end (9310 from a real 9201 archive: mp0 200G + mp1 50G restored with content, real mp8/mp9 binds, zero unusedN, clean auto-teardown; the same op failed outright on v0.74.0). TWO live-discovered PVE rules beyond the spike: explicit-params restore requires an explicit rootfs AND silently drops unlisted mountpoints — the full param set now derives from the archive's embedded config (ExtractArchiveConfig, 200 under the scoped token; bind LAYOUT stays the known constants). |
◐ | agent v0.75.0 @ b3446213; REPORT.md. Remaining: the full customer-data DR drill (GL-6/S5). (The publish follow-up landed as 0.76.0 — GL-5b/G12.) |
| G9 | Auth-on onboarding — SUPERSEDED by the customer-claim model (2026-07-12, controller v0.122.0 + hub v0.50.0). The operator-set-password premise was found NEVER to exist in shipped code (DRILL-day0-vm F-4). Replaced by a customer-owned password set via a one-time claim code the hub emails to the registered address: an unclaimed box serves ONLY the claim page (no open window), which closes the CT-log first-visit race that motivated G9. Reset rides the same code engine. Live-proven on the drill box 2026-07-12 (gate ON via the real edge; claim page / 401 on API). | ✔ | DRILL-day0-vm-2026-07-12.md; controller/hub CHANGELOGs |
| G10 | Local-API posture documented + spot-verified. Token→vmid binding is structural (server.go:23, :53–55, :153). DONE: written into the tester agreement (§2 table + §3 — vmbr0:8443 LAN surface, TLS + per-guest bearer token, cross-guest refusal). | ✔ | PETI-tester-agreement.md §2/§3 |
| G12 | Restore-test full-fidelity verification (GL-5b, agent v0.76.0). The restore-test had GL-5 finding #2's mirror image: its live-source-config override path tripped PVE's drop-unlisted-mountpoints rule, so it boot-verified scratch guests WITHOUT their storage mpN. Now: params derive from the ARCHIVE's embedded config (drRestoreOverrides, same as DR) + a mount-parity assert (restored mpN set vs the archive's; missing/mispathed/undersized/extra = FAIL naming the delta) so the rule can never regress into a green light. MountParity+MountInventory ride the hub wire record (additive). Honest cost, measured: 3m4s on the local tier (the extraction adds ~2min over data-less; cheaper than the DR-derived ~7m estimate; PBS tier will run longer). Live-proven on felhom-pve: parity ok, inventory mp0 200G + mp1 50G + 2 throwaways; a rotated-out archive volid refuses up front. |
◐ | agent v0.76.0 (published 9828c5f7…f50b); agent REPORT.md. Remaining: parity-on-real-drift (GL-6 family) + PBS-tier runtime |
| G11 | Pilot backup statement. DONE: the tester agreement states it plainly (§4 — no offsite copy yet; a dead/stolen box or dead drive without a second local target loses data; §7 step 5 asserts local backups green at onboarding). ⚠ carries the one open pilot question: Peti's local backup TARGET (does his box have a second disk/pool?) — resolved into --acl-storages at onboarding (agreement §6). |
✔ | PETI-tester-agreement.md §4/§6/§7 |
Non-gating / fast-follow (tracked, not blocking): Impl-3 shared-box operator format gate
(existing wipe-binding + mkfs-guarded gates cover the dangerous core); deviceRole/roleForMountPath
unification refactor; Tier-1/Tier-2 offsite split + production WG endpoint; CGNAT true-sim retest;
BUNDLE cert/key/token migration item; hub-floor auto-update.
4. Task sequence
| Task | Type | Repo(s) | Covers | Depends on |
|---|---|---|---|---|
| GL-1 Publish/vouch/key-pin chain | ◐ artifacts published 2026-07-08 (a63cc715); manifest bump + key pin = operator |
felhom-agent, felhom.eu (hub manifest), operator UI | G1 | — |
| GL-2 BYO-host profile + preflight + mandatory caps | ✔ DONE 2026-07-07 (02d63ed0, validated) |
felhom.eu/scripts | G2, G4, G5 | — |
| GL-3 git.token rotate + scope-down | Operator (small) | Gitea admin + config template | G3 | — |
| GL-4 Uninstaller gap-closure + key-pin fold | ✔ DONE 2026-07-08 (host-install v1.11.0, f7cc6a72) |
felhom.eu/scripts | G6 + G1-plumbing | GL-2 |
| GL-5 DR bind-override | ✔ DONE 2026-07-08 (agent v0.75.0, b3446213, live-validated) |
felhom-agent | G8 | — |
| GL-6 Demo-box drill | ✔ DONE 2026-07-08 (DRILL-GL6-2026-07-08.md; F4 fix v1.11.3 mid-drill) |
felhom.eu/scripts (v1.11.3) | G7 | GL-1, GL-2, GL-4 |
| GL-8 BYO coexistence hardening | ✔ DONE 2026-07-08 (v1.12.0, 18a556a5; F3/F6/F1) |
felhom.eu/scripts | F3/F6/F1 | GL-6 |
| GL-7 Peti day-0 runbook + onboarding | ✔ DONE 2026-07-09 (hub v0.36.0 844fbfa7; PETI-tester-agreement.md) |
felhom.eu (hub + pilot docs) | G9, G10, G11 + findings F1/F2/F3/F6/F7 | GL-6 green |
Recommended order: GL-1 and GL-3 immediately (operator-heavy, unblock everything), GL-2 next (the biggest CC task), GL-5 in parallel (independent repo), then GL-4 → GL-6 → GL-7.
5. Decision log
-
2026-07-07 — D1–D6 locked by Viktor (see §1). BYO-host reframe adopted; break-glass step identified as a BYO blocker (G2); G1 stale-vouch chain identified as item #1; G3 security O1 promoted into the gating list. Catalog healthcheck sweep confirmed CLOSED (live,
2ebe082a). -
2026-07-07 — GL-2 SHIPPED (host-install v1.10.0, felhom.eu
02d63ed0), CC report validated against source at file:line. Two spec corrections adopted, both verified at baseline: (a)--modealready existed as the retiredprovision|dr— repurposed toappliance|byowith a guiding die forprovisionand thedrstub seam preserved; (b) the installer's config write defaultedlan_resolver.enable: true(baseline :1592) — the spec's "default-off" claim was agent-side only; byo now defaults it OFF and the post-write assert still catches a--preserve-fromcarrying true (appliance keeps historical default-on). The byo skip line intentionally avoids the literal "4b/8" (the spec's Scenario B forbade the string). Harness runs red-proofs on scratch copies; every invocation uses a throwawayFELHOM_INSTALL_STATE_DIR(new env override, spec-permitted). -
2026-07-08 — GL-1 EXECUTED (felhom.eu
a63cc715, felhom-agent4c408467), validated: agent 0.74.0 published from the exact running felhom-pve bytes (sha independently re-verified via anonymous fetch, byte-exact); golden 0.103.0 baked clean-room on the virgin drill VM and published (612MB, rootfs+mp0+mp1 all in the vzdump); drill environment restored tovirgin. Deviations sound: debian-13 template pveam-downloaded in-VM; bake detached viasystemd-run. Gate 3c: packages anonymously readable → G3 rotation unblocked. Follow-on probe found the whole Gitea instance anonymously readable (all repos public) — operator ruling required (see G3 + operator actions). -
2026-07-08 — GL-4 SHIPPED (host-install v1.11.0, felhom.eu
f7cc6a72): G6 uninstall gap-closure (self-update artifacts, per-drive plain-umount with busy-warn, KEPT-vs-WIPED statement both modes, guest-only bind-store drive note) + the G1 key-pin day-0 PLUMBING (OPERATOR_KEY_*constants empty-by-default +--operator-pubkey-file→authz.signers; no-keys-resolved KEEPS preserved signers — a pinned box is never silently un-pinned). Harness 28/28 on felhom-pve incl. a full-uninstall DRY transcript vs live 9201; red-proofs RP-1..3. Statuses: G6 → implemented-awaiting-GL-6; G1 key-pin plumbing → done, ceremony pending. -
2026-07-08 — GL-5 SHIPPED (agent v0.75.0,
b3446213, live on felhom-pve): G8 DR bind overrides + 4d real-bind swap, scratch-DR live-validated (see G8). The spike's known-constants verdict held for the bind LAYOUT but PVE's all-or-nothing explicit-params restore forced two live corrections (explicit rootfs; full storage-mpN pass-through from the archive's embedded config — without it the DR guest boots WITHOUT its data volumes, a data-loss restore that looks green). NOTE: no host-loss DR runbook exists yet to simplify (the GL-5 spec assumed one) — the DR procedure doc is GL-6/S5 material. Follow-ups recorded: publish agent 0.75.0 (the published 0.74.0 lacks working DR); restore-test has the same dropped-mountpoint exposure in reverse (boot-verifies without mp0/mp1 — candidate: reusedrRestoreOverrides); DR selftest KeepMAC=true duplicates a live source's MAC briefly. -
2026-07-08 — GL-5b SHIPPED (agent v0.76.0,
b1697874, live + PUBLISHED9828c5f7…f50b): new G12 — the restore-test now verifies FULL fidelity (archive-derived params viadrRestoreOverrides+ a mount-parity assert; the old live-source-config path deleted with its tests). Live run: parity ok, inventory mp0 200G + mp1 50G + 2 throwaways, 3m4s local tier (measured — cheaper than the DR-derived ~7m estimate); a rotated-out archive volid refuses up front (good failure mode). 0.75.0 superseded unpublished; the ONE manifest bump goes straight to 0.76.0. Scenario-B red-proof run→fail→revert; bringup.go zero line changes (DR re-run trigger not fired). -
2026-07-08 — GL-6 DRILL COMPLETE (supervised, Viktor gating;
DRILL-GL6-2026-07-08.md, felhom.eu87ba30ae). Two full destroy/rebuild cycles on felhom-pve (byo #2 + appliance #6) + two clean uninstalls; abort-path (local+PBS backup, restore-test parity ok) verified before any destroy. Key-pin legs 1–4 all green (box==repo==manager fingerprints; armed from first boot; the pinned operational key authorized a real signedagent_updateround-trip 0.76.0→0.76.1→0.76.0). C7 live-validated (verify's pool assert fired on induced drift). F4 (resume-correctness, HIGH) found + FIXED mid-drill (host-install v1.11.3) + live-proven (the appliance install then ran single-shot). Gate-0 ruling shipped v1.11.2 (empty customer git creds → anonymous artifact fetch; all 12 fetch targets 200-anon-verified). New findings F1/F2/F3/F6/F7 filed for a small installer follow-up (none block Peti). G2/G4/G5/G6/G7 → LIVE-VALIDATED; G1 → DONE; G9 → deferred to GL-7; G10 (open dashboard until operator password) → GL-7 prerequisite. -
2026-07-08 — GL-8 SHIPPED (host-install v1.12.0, felhom.eu
18a556a5): BYO coexistence hardening from the GL-6 findings — F3 leaf guard narrowed tofelhom_guests(Peti's fresh install on his populated box needs no--allow-new-leaf— the reason GL-8 shipped BEFORE GL-7), F6 byo preflight REFUSES a foreign:53with a remediation message (**Viktor's ruling: refuse- instruct, NO stop/mask — Felhom does not mutate a DNS service on a host it doesn't own**; the
break-glass analog), F1 uninstall purges the config
.bak*siblings (a GL-6 residue held a live hub api_key). F6 live-proven on felhom-pve (byo preflight refuses at :53 — the exact GL-6 scenario). Harness 36/36 + red-proofs RP-F3/F6/F1; GL-2/GL-4 regression green. F2/F7 remain open (non-blocking). GL-7 unblocked.
- instruct, NO stop/mask — Felhom does not mutate a DNS service on a host it doesn't own**; the
break-glass analog), F1 uninstall purges the config
-
2026-07-09 — GL-7 SHIPPED (hub v0.36.0, felhom.eu
844fbfa7; deploy02c748eb). Two coupled changes to the operator customer page, security-first: (1) passphrase hardening — the per-customer retrieval passphrase was rendered in cleartext twice (the visible#retrieval-pwnode and baked into the Option-3 debug curlX-Retrieval-Password:header). Now masked by default (bullet run) with reveal + copy controls (value indata-secret, the existing model), and the Option-3 command carries a<YOUR-RETRIEVAL-PASSWORD>placeholder instead of the secret. A zero-secret-in-DOM reveal-on-demand fetch is a noted follow-up, deliberately NOT scoped here. (2) interactive install-command generator — the three hard-coded<code>blocks became a client-side builder (vanilla JS, no framework/CDN/network) that assembles a live install command from form controls, emitting ONLY real host-install v1.12.0 flags, download-then-run shape, with a graceful JS-off static fallback and a CustomerID prefilled from the server. The control surface is a curated subset (mode/cores/memory/vmid/node/acl/pubkey/preserve + skip/dry-run/ preflight/allow-new-leaf); the seven dangerous/operator-only flags (--force,--rotate-recovery,--enable-oob,--remove-golden,--uninstall,--adopt-pool,--rescope-acl) are NEVER offered as controls. Render testsTestTemplates_PassphraseHardened+TestTemplates_InstallGeneratorcover both (green gate passed on the committed source); the passphrase test red-proofs by reverting the Option-3 block to the raw secret. Deployed via ArgoCD (Synced/Healthy, rollout confirmed, live imagefelhom-hub:0.36.0,Listening on :8080). Tester agreement written (PETI-tester-agreement.md): BYO trust boundary (break-glass/OOB/WG all off, non-root agent, pool-scoped token), honest limitations (no offsite backup, physically-removable-drive caveat F2, pool-reassert-bring-up-only F7,:53-must-be-free F6), exit rights (uninstall keeps data), Peti's box facts (80c/128 GB → caps 12/32768,sajatfelhom.hutunnel re-point), the byo install command, and the onboarding sequence (preflight → install → G9 password-set → tunnel → backup-green). G9/G10 closed; G11 closed with the one open pilot question folded into the agreement's pre-install checklist. Note: the hub UI is operator-password-gated (CC cannot log in) — verification is the render tests + the deploy checks, per the repo's stated policy.
6. Open questions & operator actions
Operator actions (Viktor):
- Hub manifest bump — DONE (confirmed at GL-6 Phase 0: the manifest vouches agent
0.76.0+ golden0.103.0). No action. - Installer findings — F1/F3/F6 FIXED in host-install v1.12.0 (GL-8,
18a556a5). F3: leaf guard narrowed tofelhom_guests(fresh byo install on a populated host needs no--allow-new-leaf). F6: byo preflight REFUSES a foreign:53with remediation (Viktor's ruling — no stop/mask; live- proven on felhom-pve). F1: uninstall purges config.bak*siblings. Still open (none block Peti): F2 (per-drivemnt-*.mountunits survive uninstall), F7 (pool re-assert is bring-up-only — no continuous heal;--adopt-poolrepairs). A later small pass, or fold into a future task. - Gitea visibility ruling (new, see G3): decide deliberately — (a) keep felhom repos public
as an open-source posture, but audit + privatize
homelab-manifestsand the personal repos; or (b) lock the instance, which REQUIRES first proving the day-0 package fetch with a read-scoped token (the anonymous path dies). Recommendation: (a) — it preserves the working day-0 path; do the homelab-manifests secrets audit either way. - G3 token work: mint the scoped read-only token, rotate out the package-WRITE one, fill the
demo customer's empty
git.username/git.tokenin the hub-served config. - Operator-key pin ceremony on felhom-pve (+ the small day-0 follow-up — candidate GL-4 fold).
- Commit THIS doc to
felhom.eu/documentation/pilot/GO-LIVE-PACKAGE.md(still absent after two tasks — paste it to CC with the next task so wrap-ups stop falling back to CONTEXT.md).
Open questions:
- G5: CPU/RAM cap values for Peti's guest — RESOLVED: 12 cores / 32768 MiB (his 80c/128 GB box).
- G11/GL-7: the local backup TARGET on Peti's box, given
felhom-pbsis unreachable from his LAN. Still open, but now owned by the tester agreement (PETI-tester-agreement.md§6): the ONE thing to confirm with Peti before finalising his install command is whether his server has a second disk/pool — if yes it becomes the--acl-storagesbackup target (real local resilience); if no, backups share the guest's pool (degraded — one drive failure loses both, must be stated to him). Resolve at onboarding; it changes only the--acl-storagesvalue, nothing structural.