felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

---

felhom-host-install.sh v1.9.0 — Pool.Audit for the stale-lock reaper (A1) (2026-07-03)

Class: implementation (this repo's share of the A1 fix; agent side = felhom-agent v0.62.0, see that repo's REPORT for the full evidence). Spec basis: documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md. Commit 639a57e (baseline 5e3dfcb).

Change: PVE_PRIVS_GUEST gains Pool.Audit (12 → 13 privs; comment cites the spike and why Pool.Allocate does not satisfy the read), SCRIPT_VERSION 1.8.0 → 1.9.0. No structural change — _ensure_role already role modifys to the exact set, so --rescope-acl is the idempotent upgrade path; remove_scoped_acl deletes by role name and needed nothing. Gates: bash -n OK, reuse_refs_check.py OK (31 paths).

Live run (felhom-pve, the PUSHED script fetched from Gitea raw): --rescope-acl --vmid 9201 → roles re-ensured; after: FelhomAgentGuest = Pool.Allocate,Pool.Audit,VM.*… — Base/Store unchanged. Production-token GET /pools/felhom went 403 → 200 (members [9201]). Running v0.61.0 agent unaffected; agent v0.62.0 deployed AFTER the rescope (order per spec) — startup shows stale-lock: scanning pool guests pool=felhom listed=1 scanned=1 and 47/47 capabilities incl. pve:pool-read ok (also verified in the hub's stored host report).

Also in this commit: REUSE.md §2 errata — the secret-handling row claimed gitea-creds is out-of-band; it is in fact COMMITTED in manifests/felhom.secret.yaml AND live-consumed by hub.yaml. §3 trap row now lists it too. Rotation + de-git of the 3 committed secrets remains a pending operator task (spike appendix).

Operator follow-ups: hub Day-0 artifact manifest → vouch agent 0.62.0 (sha256 ed1192c9ae8f355dee19128cf4b01984ba7398e860b4a16a8009655b84b32d81); secrets rotation above.