admin
a63cc7151b
Agent = the live felhom-pve bytes (sha 1ec3f588..76af05, round-trip verified); golden baked clean-room in the drill VM (build-golden v2.0.0, controller 0.103.0, all integrity gates green, sha 8481e8a1..6026e) and published 201. Both anon-fetch-verified (Gate 3c: packages world-readable -> G3 read-only token rotation cannot break fetches; installer-side empty-token die is the real precondition). Drill VM restored to virgin. OPERATOR NEXT: Day-0 manifest bump to the four recorded values. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
61 lines
3.6 KiB
Markdown
61 lines
3.6 KiB
Markdown
# felhom.eu — task reports
|
||
|
||
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
||
|
||
## RUNBOOK GL-1 — publish agent 0.74.0 + bake/publish golden 0.103.0 (2026-07-07)
|
||
|
||
Full execution record with per-gate evidence:
|
||
`documentation/pilot/RUNBOOK-GL1-publish-2026-07-07.md`. Docs-only commit; no code changed, no
|
||
production host mutated (felhom-pve read-only; all root work inside the disposable drill VM).
|
||
|
||
### The four operator values (hub Day-0 manifest — Configs → Day-0 artifacts)
|
||
|
||
```
|
||
AGENT_VERSION=0.74.0
|
||
AGENT_SHA256=1ec3f58842edce1e9e32d022eaef15b7ff599c658c7a36bfe7833c708076af05
|
||
GOLDEN_VERSION=0.103.0
|
||
GOLDEN_SHA256=8481e8a14e2aa0abe3831cc40e5aea4c32f2017e7561c15dca8a674df6a6026e
|
||
```
|
||
|
||
### Gate outcomes (all PASS)
|
||
|
||
- **0a–0d**: baselines exact (`ced60ddf` / `59eb3bea` / `02d63ed0`; agent 0.63.0 + golden 0.98.3
|
||
the last published, targets 404); drill VM + `virgin` snapshot intact; controller image
|
||
0.103.0 resolvable; headroom ample.
|
||
- **1a/1b**: felhom-pve's RUNNING binary (`readlink /proc/…/exe`, no pending A/B marker) is
|
||
0.74.0; those exact bytes (hash-stable across both copy hops) published via
|
||
`publish-agent.sh` from `main`@`ced60ddf` — PUT 201, round-trip GET sha match.
|
||
- **2a/2b**: clean-room bake on the virgin-restored drill VM (build-golden.sh v2.0.0):
|
||
overlay2 + both split-volumes as separate mounts, rootfs+mp0+mp1 ALL included in the vzdump
|
||
(no exclusions, no FATAL), archive 583MB, publish HTTP 201; transcript token-leak grep = 0.
|
||
Deviations: debian-13 template pveam-downloaded inside (virgin never has it, checksum
|
||
verified); bake launched via `systemd-run` (bare nohup didn't survive ssh session close).
|
||
- **3a/3b**: both artifacts fetched **ANONYMOUSLY** and hashed to exactly the published sha
|
||
(golden 611 696 321 bytes, streamed+hashed+deleted); off-LAN HEAD 200 from the CC machine too.
|
||
|
||
### Gate 3c finding (feeds G3) — read-credential sufficiency
|
||
|
||
The specified reviewer read-only token (`8417…4140`) was not locatable by CC anywhere in reach —
|
||
the gates ran with **no credential at all and passed**: the generic packages are anonymously
|
||
world-readable. Therefore rotating the customer `git.token` to read-only **cannot break** the
|
||
artifact fetch path (G3 unblocked from this side). Nuance: `resolve_git_creds` in host-install
|
||
**dies on an empty token** even though Gitea would serve the fetch anonymously — the requirement
|
||
is script-side; customer configs still need a (read-scoped) token until a small installer
|
||
follow-up makes it optional. This also reframes GL-2's finding that demo-felhom's git credentials
|
||
are EMPTY: the fetch would work, the installer's precondition is what fails.
|
||
|
||
### Drill-VM end state
|
||
|
||
Guest 9100 destroyed (`--purge`), in-VM cred file shredded, VM powered off, qcow2 **restored to
|
||
`virgin`** (verified) — environment exactly as found. Evidence kept: `~/drill/bake-0.103.0.log`
|
||
on the build server.
|
||
|
||
### Follow-ups
|
||
|
||
1. **OPERATOR — hub Day-0 manifest bump** to the four values above (until then fresh installs
|
||
land agent 0.63.0 + golden 0.98.3).
|
||
2. **Operator-key pin** (out of GL-1 scope): day-0 ships no operator pubkey → self-update dormant
|
||
on fresh boxes; pin the real key + a small host-install follow-up (candidate: fold into GL-4).
|
||
3. **G3 rotation** unblocked per Gate 3c; also fixes demo-felhom's empty git credentials.
|
||
4. **GL-6** consumes the bumped manifest end-to-end (deliberately not run here).
|