admin 8c8196e82b docs: AUDIT — host-root + local-API blast radius (non-Proxmox-token axes) ...

Companion to CAMPAIGN-pool-effects: red-teams the four axes the pool campaign
did not cover (provenance-gating of destructive ops, sudoers↔fine-gate coverage,
local-API within-scope blast radius, mkfs/claim classifier, signed-vs-self-serve
boundary). Verifies the v0.60.0 F1 fix is complete; finds no new HIGH/MED. One
F1-sibling (stale-lock pool-blind reaper, LOW) + LOW/INFO defense-in-depth
residuals. Read-only static trace against felhom-agent @cc93dae/v0.60.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-02 10:43:19 +02:00

..

AUDIT-blast-radius-hostroot-localapi-2026-07-02.md

docs: AUDIT — host-root + local-API blast radius (non-Proxmox-token axes)

2026-07-02 10:43:19 +02:00

AUDIT-hub-gui-2026-06-30.md

docs(audit): hub GUI vs current architecture findings (2026-06-30)

2026-06-30 20:13:48 +02:00

B3-storage-lifecycle-2026-06-15.md

docs: B3 live storage-lifecycle exercise + feature sweep (2026-06-15)

2026-06-15 12:39:44 +02:00

bughunt-reconcile-2026-06-13.md

…

CAMPAIGN-pool-effects-2026-07-01.md

docs: F3 provisioning runbook (vmid from full host list) + campaign F1/F2 resolution banner

2026-07-02 10:27:17 +02:00

deep-sweep-2026-06-13.md

…

DIAGNOSE-drive-bind-after-reprovision-2026-06-23.md

docs(audit): DIAGNOSE re-enrolled drives not binding after 9201 re-provision

2026-06-23 17:15:30 +02:00

FINDING-app-email-rollout-2026-06-29.md

docs: FINDING — app-email rollout mechanism gaps (calcom/nextcloud/immich)

2026-06-29 10:32:56 +02:00

live-drive-findings-2026-06-14.md

…

live-drive-fixspec-2026-06-14.md

docs: F9/F20-BUG2/F20-BUG3 FIXED (agent v0.31.0, live-validated); queue golden controller-tag follow-up

2026-06-14 15:43:07 +02:00

RUNBOOK-usb-enrollment-3bfix-2026-07-01.md

docs: RUNBOOK result — USB enrollment on pool-scoped ACL (residual CLOSED)

2026-07-01 13:52:44 +02:00

SPIKE-agent-pin-mismatch-2026-06-29.md

spike(pin-mismatch): §9 Outcome — R1 executed, controller↔agent service restored

2026-06-29 15:08:58 +02:00

SPIKE-controller-agent-channel-health-2026-06-29.md

docs: felhom.eu REPORT (HostLeafChecker) + hub README + self-health arc complete (spike doc)

2026-06-29 23:32:12 +02:00

SPIKE-controllerswap-narrow-grants-2026-06-29.md

docs: controller-swap narrow-grant Option A IMPLEMENTED (agent v0.45.0) — spike + multidrive pointers resolved

2026-06-29 19:46:17 +02:00

SPIKE-day0-firstboot-handshake-2026-06-26.md

REPORT + Day-0 doc: BUNDLE slice (hub v0.16.0 artifact manifest + host-install v1.1.0 self-install)

2026-06-28 09:03:34 +02:00

SPIKE-decommission-migration-2026-06-14.md

docs(spike): bake in locked fork decisions (B0 gate cleared)

2026-06-14 18:14:08 +02:00

SPIKE-dr-recipe-2026-06-16.md

docs(audit): SPIKE — Phase 2 DR recipe + storage diagnosis (report-only)

2026-06-16 14:18:39 +02:00

SPIKE-drive-enrollment-2026-07-01.md

docs: spike status — Impl-2b DONE (raw enrollment live: ctrl v0.95.0 + agent v0.58.0)

2026-07-01 21:27:48 +02:00

SPIKE-infra-backup-2026-06-15.md

docs(audit): SPIKE — characterize Infra Backup (revive vs retire)

2026-06-16 10:04:55 +02:00

SPIKE-intermediary-mount-2026-06-15.md

docs(spike): stable intermediary mount — swap drive underneath (C1-immune, no-restart)

2026-06-15 15:26:37 +02:00

SPIKE-multidrive-mutual-exclusion-2026-06-29.md

docs: controller-swap narrow-grant Option A IMPLEMENTED (agent v0.45.0) — spike + multidrive pointers resolved

2026-06-29 19:46:17 +02:00

SPIKE-nas-storage-2026-06-29.md

spike: NAS network storage (media automount + restic backup target) — findings

2026-06-29 11:44:40 +02:00

SPIKE-pool-scoped-acl-2026-07-01.md

docs: REPORT + spike-doc status for host-install v1.6.0 (pool-scoped ACL, live-migrated)

2026-07-01 13:02:16 +02:00

SPIKE-raw-drive-enroll-2026-06-15.md

docs: SPIKE raw-drive plug-and-enroll (GATE, 2026-06-15)

2026-06-15 10:57:33 +02:00

SPIKE-smtp-app-relay-2026-06-28.md

docs(audit): SPIKE findings — on-box SMTP app-relay (apps → shim → hub → Resend)

2026-06-28 19:27:07 +02:00

SPIKE-userdata-layout-2026-06-14.md

docs(spike): userdata/ layout + shared-storage ownership mapping (report-only gate)

2026-06-14 21:15:24 +02:00

storage-lifecycle-acceptance-2026-06-15.md

docs: M3 live re-verification addendum (closes E14/E15 residual) + two controller UI fixes

2026-06-15 21:53:10 +02:00

TESTRUN-fullstack-2026-06-29.md

audit: §D supervised reboot done — F2-a + F2-b red-proofs PASS (findings closed)

2026-06-30 10:04:59 +02:00