admin
996526273a
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
35 lines
2.1 KiB
Markdown
35 lines
2.1 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
---
|
|
|
|
## felhom-host-install.sh v1.9.0 — Pool.Audit for the stale-lock reaper (A1) (2026-07-03)
|
|
|
|
**Class:** implementation (this repo's share of the A1 fix; agent side = felhom-agent **v0.62.0**,
|
|
see that repo's REPORT for the full evidence). Spec basis:
|
|
`documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. Commit **`639a57e`**
|
|
(baseline `5e3dfcb`).
|
|
|
|
**Change:** `PVE_PRIVS_GUEST` gains **`Pool.Audit`** (12 → 13 privs; comment cites the spike and
|
|
why `Pool.Allocate` does not satisfy the read), `SCRIPT_VERSION` 1.8.0 → **1.9.0**. No structural
|
|
change — `_ensure_role` already `role modify`s to the exact set, so `--rescope-acl` is the
|
|
idempotent upgrade path; `remove_scoped_acl` deletes by role name and needed nothing. Gates:
|
|
`bash -n` OK, `reuse_refs_check.py` OK (31 paths).
|
|
|
|
**Live run (felhom-pve, the PUSHED script fetched from Gitea raw):**
|
|
`--rescope-acl --vmid 9201` → roles re-ensured; after: `FelhomAgentGuest` =
|
|
`Pool.Allocate,Pool.Audit,VM.*…` — Base/Store unchanged. Production-token `GET /pools/felhom`
|
|
went 403 → **200 (members [9201])**. Running v0.61.0 agent unaffected; agent v0.62.0 deployed
|
|
AFTER the rescope (order per spec) — startup shows
|
|
`stale-lock: scanning pool guests pool=felhom listed=1 scanned=1` and 47/47 capabilities incl.
|
|
`pve:pool-read` ok (also verified in the hub's stored host report).
|
|
|
|
**Also in this commit:** REUSE.md §2 errata — the secret-handling row claimed `gitea-creds` is
|
|
out-of-band; it is in fact COMMITTED in `manifests/felhom.secret.yaml` AND live-consumed by
|
|
hub.yaml. §3 trap row now lists it too. Rotation + de-git of the 3 committed secrets remains a
|
|
pending operator task (spike appendix).
|
|
|
|
**Operator follow-ups:** hub Day-0 artifact manifest → vouch agent **0.62.0**
|
|
(sha256 `ed1192c9ae8f355dee19128cf4b01984ba7398e860b4a16a8009655b84b32d81`); secrets rotation above.
|