admin
0826e41b31
gates / gates (push) Successful in 32s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
63 lines
3.3 KiB
Markdown
63 lines
3.3 KiB
Markdown
# Golden 0.296.0 — bake + publish + vouch, 2026-10-05 (late afternoon)
|
||
|
||
Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1 steps 1–5, in the drill VM on DooPlex.
|
||
|
||
| | Previous (`../golden-0.295.0-2026-10-05/`) | This bake |
|
||
|---|---|---|
|
||
| `build-golden.sh` | v3.2.0 (sha256 `645b3b659cba…`) | same file, unchanged (agent repo `configs/build-golden.sh`, sha256 `645b3b659cba…`) |
|
||
| Controller | `felhom-controller:0.295.0` | **`felhom-controller:0.296.0`** (MinAgent 0.131.0, unchanged) |
|
||
| Docker engine | the operator-approved set `os-docker-20261004-142842` | same pinned set (still the only approved release — read from the hub's System page) |
|
||
| Guest packages | template | template — `GOLDEN_GUEST_PKGS` EMPTY (no guest release approved) |
|
||
|
||
## Launch
|
||
|
||
- Drill VM reverted to `virgin` (no qemu running before), cold-booted per §4.0 at 10:16:31 UTC; `pveversion` = `pve-manager/9.2.2`.
|
||
- `pveam update` → `update successful`; template `debian-13-standard_13.6-1_amd64.tar.zst`, `checksum verified`.
|
||
- `/root/bake-run.sh` reads the token from the file; launched as transient unit `golden-bake` at 10:17:29 UTC.
|
||
- Token copied file → file (`scp`). `systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token>` = **0**
|
||
(control with the token appended = **1**).
|
||
|
||
## Pass markers (from `bake.log`)
|
||
|
||
```
|
||
[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie docker-buildx-plugin=0.37.1-1~debian.13~trixie docke
|
||
[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a
|
||
[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): 49
|
||
docker OK (overlay2; data-root /var/lib/docker)
|
||
live-restore: on
|
||
INFO: including mount point rootfs ('/') in backup
|
||
INFO: including mount point mp0 ('/var/lib/felhom') in backup
|
||
[golden] pre-delete existing: HTTP 404 (404/204 expected)
|
||
[golden] upload OK (HTTP 201)
|
||
GOLDEN_VERSION=0.296.0
|
||
GOLDEN_SHA256=65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f
|
||
```
|
||
|
||
No `excluding` and no `FATAL` in the log (grep count 0).
|
||
|
||
## Round trip
|
||
|
||
== round trip 2026-10-05T10:23:04Z: anonymous GET .../generic/felhom-golden/0.296.0/golden.tar.zst
|
||
HTTP 200
|
||
bytes 648611216
|
||
sha256 65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f
|
||
printed 65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f
|
||
|
||
## Secrets
|
||
|
||
Saved-log leak grep for the literal token: **0**; positive control (a throwaway copy with the token appended): **1**,
|
||
copy shredded.
|
||
|
||
## Vouch (step 5)
|
||
|
||
`POST /configuration/artifacts` (operator Basic auth + `X-Felhom-Operator`, hub v0.135.0): agent **0.146.1**, golden
|
||
**0.296.0**, `min_agent` **0.131.0**, wrapper sha empty → `303 flash=artifacts_set`; hub log `Artifact manifest set:
|
||
agent=0.146.1 golden=0.296.0 min_agent="0.131.0" … bundle_sha="42333e96…"` (`../../audits/hub-safety-2026-10-05/partH/vouch.txt`).
|
||
Per-customer controller floors 0.296.0 for demo-hp, demo-felhom, tester-1; the global floor unchanged (Tester 2 not moved).
|
||
|
||
## Teardown
|
||
|
||
`pct destroy 9100 --purge`; `shred -u` of the token, the runner script and the log in the VM (log copied off first);
|
||
`poweroff`; qemu gone (`ps -eo comm | grep -c qemu-system-x86` = 0); `qemu-img snapshot -a virgin`. Host: nothing
|
||
provisioned.
|