felhom.eu/documentation/tests/golden-0.212.0-2026-08-12/RESULT.md

Golden bake 0.212.0 — 2026-08-12

Baked in the drill VM on DooPlex per RUNBOOK-manual-build.md §4.0/§4.1. Reverted to virgin before and after; build guest 9100 destroyed --purge; /root residue check empty.

GOLDEN_VERSION	0.212.0
GOLDEN_SHA256	4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8
controller baked	gitea.dooplex.hu/admin/felhom-controller:0.212.0
MinAgent (from the controller CHANGELOG header)	0.127.0
archive	local:backup/vzdump-lxc-9100-2026_08_12-13_56_29.tar.zst
published	…/generic/felhom-golden/0.212.0/golden.tar.zst, 656 611 277 B, upload OK (HTTP 201)
template	debian-13-standard_13.6-1_amd64.tar.zst
drill VM	pve-manager/9.2.2, kernel 7.0.2-6-pve

Acceptance markers — counted with grep -F from the start

marker	count
docker OK (overlay2	1
including mount point rootfs	1
including mount point mp0	1 (there is no mp1 — R-165 collapsed the two data volumes)
upload OK (HTTP 201)	1
FATAL	0
excluding	0

The 0.211.0 run had two of these return a false 0 through shell quoting; this run used grep -F with a quoted loop variable throughout, which is why the counts are trustworthy without a re-run.

Fetchability — verified on the SERVED bytes

downloaded: 656611277 bytes
sha256:     4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8

Identical to GOLDEN_SHA256. The controller image was independently confirmed retrievable (docker manifest inspect …:0.212.0).

Secret handling

Token copied file→file, read inside the VM by a runner script, never on a command line. systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>" = 0. Leak grep on the committed log = 0, believable because the grep was first shown to work: a throwaway copy with the token appended grepped 1, then was shredded. Token, bake script, runner and log all shred -u'd in the VM.

NOT DONE

The Day-0 vouch has not been made — the operator's. Three fields together: golden_version 0.212.0, agent_version 0.128.0, min_agent 0.127.0.