admin
a63cc7151b
Agent = the live felhom-pve bytes (sha 1ec3f588..76af05, round-trip verified); golden baked clean-room in the drill VM (build-golden v2.0.0, controller 0.103.0, all integrity gates green, sha 8481e8a1..6026e) and published 201. Both anon-fetch-verified (Gate 3c: packages world-readable -> G3 read-only token rotation cannot break fetches; installer-side empty-token die is the real precondition). Drill VM restored to virgin. OPERATOR NEXT: Day-0 manifest bump to the four recorded values. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
3.6 KiB
felhom.eu — task reports
Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.
RUNBOOK GL-1 — publish agent 0.74.0 + bake/publish golden 0.103.0 (2026-07-07)
Full execution record with per-gate evidence:
documentation/pilot/RUNBOOK-GL1-publish-2026-07-07.md. Docs-only commit; no code changed, no
production host mutated (felhom-pve read-only; all root work inside the disposable drill VM).
The four operator values (hub Day-0 manifest — Configs → Day-0 artifacts)
AGENT_VERSION=0.74.0
AGENT_SHA256=1ec3f58842edce1e9e32d022eaef15b7ff599c658c7a36bfe7833c708076af05
GOLDEN_VERSION=0.103.0
GOLDEN_SHA256=8481e8a14e2aa0abe3831cc40e5aea4c32f2017e7561c15dca8a674df6a6026e
Gate outcomes (all PASS)
- 0a–0d: baselines exact (
ced60ddf/59eb3bea/02d63ed0; agent 0.63.0 + golden 0.98.3 the last published, targets 404); drill VM +virginsnapshot intact; controller image 0.103.0 resolvable; headroom ample. - 1a/1b: felhom-pve's RUNNING binary (
readlink /proc/…/exe, no pending A/B marker) is 0.74.0; those exact bytes (hash-stable across both copy hops) published viapublish-agent.shfrommain@ced60ddf— PUT 201, round-trip GET sha match. - 2a/2b: clean-room bake on the virgin-restored drill VM (build-golden.sh v2.0.0):
overlay2 + both split-volumes as separate mounts, rootfs+mp0+mp1 ALL included in the vzdump
(no exclusions, no FATAL), archive 583MB, publish HTTP 201; transcript token-leak grep = 0.
Deviations: debian-13 template pveam-downloaded inside (virgin never has it, checksum
verified); bake launched via
systemd-run(bare nohup didn't survive ssh session close). - 3a/3b: both artifacts fetched ANONYMOUSLY and hashed to exactly the published sha (golden 611 696 321 bytes, streamed+hashed+deleted); off-LAN HEAD 200 from the CC machine too.
Gate 3c finding (feeds G3) — read-credential sufficiency
The specified reviewer read-only token (8417…4140) was not locatable by CC anywhere in reach —
the gates ran with no credential at all and passed: the generic packages are anonymously
world-readable. Therefore rotating the customer git.token to read-only cannot break the
artifact fetch path (G3 unblocked from this side). Nuance: resolve_git_creds in host-install
dies on an empty token even though Gitea would serve the fetch anonymously — the requirement
is script-side; customer configs still need a (read-scoped) token until a small installer
follow-up makes it optional. This also reframes GL-2's finding that demo-felhom's git credentials
are EMPTY: the fetch would work, the installer's precondition is what fails.
Drill-VM end state
Guest 9100 destroyed (--purge), in-VM cred file shredded, VM powered off, qcow2 restored to
virgin (verified) — environment exactly as found. Evidence kept: ~/drill/bake-0.103.0.log
on the build server.
Follow-ups
- OPERATOR — hub Day-0 manifest bump to the four values above (until then fresh installs land agent 0.63.0 + golden 0.98.3).
- Operator-key pin (out of GL-1 scope): day-0 ships no operator pubkey → self-update dormant on fresh boxes; pin the real key + a small host-install follow-up (candidate: fold into GL-4).
- G3 rotation unblocked per Gate 3c; also fixes demo-felhom's empty git credentials.
- GL-6 consumes the bumped manifest end-to-end (deliberately not run here).