felhom.eu/documentation/tests/golden-0.297.0-2026-10-05/README.md

Golden 0.297.0 — bake + publish + vouch, 2026-10-05 (night, burn-down round 2)

Procedure: documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–5, in the drill VM on DooPlex.

	Previous (../golden-0.296.0-2026-10-05/)	This bake
build-golden.sh	sha256 645b3b659cba…	same file, unchanged (agent repo configs/build-golden.sh)
Controller	felhom-controller:0.296.0	felhom-controller:0.297.0 (MinAgent 0.131.0, unchanged)
Docker engine	the approved set os-docker-20261004-142842	same pinned set (same GOLDEN_DOCKER_PKGS as the 0.296.0 bake)
Guest packages	template	template — GOLDEN_GUEST_PKGS EMPTY

Launch

• No qemu running before; drill VM reverted to virgin, cold-booted per §4.0; pveversion = pve-manager/9.2.2.
• pveam update → update successful; pveam available listed debian-13-standard_13.6-1_amd64.tar.zst (downloaded).
• /root/bake-run.sh reads the token from the file; transient unit golden-bake. Token copied file → file (scp); systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token> = 0.

Pass markers (from bake.log, this folder)

  docker OK (overlay2; data-root /var/lib/docker)
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.297.0
GOLDEN_SHA256=8cebc42e15b091f0c2f8bee1170ec66b97de1a6bf14b7aa20dca82443c7e79ad

No excluding and no FATAL in the log (grep count 0).

Round trip — 02-round-trip.txt

Anonymous GET of …/generic/felhom-golden/0.297.0/golden.tar.zst: HTTP 200, 648 208 028 bytes, sha256 equals the printed one.

Secrets

Saved-log leak grep for the literal token: 0; positive control (a throwaway copy with the token appended): 1, copy shredded.

Vouch (step 5)

POST /configuration/artifacts (Basic + X-Felhom-Operator, hub v0.137.0): agent 0.147.0, golden 0.297.0, min_agent 0.131.0 → 303 flash=artifacts_set; hub log Artifact manifest set: agent=0.147.0 golden=0.297.0 min_agent="0.131.0" … bundle_sha="326527d0…". Per-customer floors 0.297.0 (declared MinAgent 0.131.0) for demo-hp, demo-felhom, tester-1 (../../audits/burndown2-2026-10-05/delivery/vouch-golden-floors.txt). The global floor unchanged.

Teardown

pct destroy 9100 --purge (rc 0); shred -u of the token, runner script, bake script and log in the VM (log copied off first); poweroff; qemu gone (ps -eo comm | grep -c qemu-system-x86 = 0); qemu-img snapshot -a virgin. Host: nothing provisioned.