felhom.eu/documentation/tests/golden-0.296.0-2026-10-05

Golden 0.296.0 — bake + publish + vouch, 2026-10-05 (late afternoon)

Procedure: documentation/runbooks/RUNBOOK-manual-build.md §4.0 and §4.1 steps 1–5, in the drill VM on DooPlex.

	Previous (../golden-0.295.0-2026-10-05/)	This bake
build-golden.sh	v3.2.0 (sha256 645b3b659cba…)	same file, unchanged (agent repo configs/build-golden.sh, sha256 645b3b659cba…)
Controller	felhom-controller:0.295.0	felhom-controller:0.296.0 (MinAgent 0.131.0, unchanged)
Docker engine	the operator-approved set os-docker-20261004-142842	same pinned set (still the only approved release — read from the hub's System page)
Guest packages	template	template — GOLDEN_GUEST_PKGS EMPTY (no guest release approved)

Launch

• Drill VM reverted to virgin (no qemu running before), cold-booted per §4.0 at 10:16:31 UTC; pveversion = pve-manager/9.2.2.
• pveam update → update successful; template debian-13-standard_13.6-1_amd64.tar.zst, checksum verified.
• /root/bake-run.sh reads the token from the file; launched as transient unit golden-bake at 10:17:29 UTC.
• Token copied file → file (scp). systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token> = 0 (control with the token appended = 1).

Pass markers (from bake.log)

[golden] Docker engine set PINNED to the approved release: containerd.io=2.3.6-1~debian.13~trixie docker-buildx-plugin=0.37.1-1~debian.13~trixie docke
[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a
[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): 49
  docker OK (overlay2; data-root /var/lib/docker)
  live-restore: on
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden]   pre-delete existing: HTTP 404 (404/204 expected)
[golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.296.0
GOLDEN_SHA256=65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f

No excluding and no FATAL in the log (grep count 0).

Round trip

== round trip 2026-10-05T10:23:04Z: anonymous GET .../generic/felhom-golden/0.296.0/golden.tar.zst
HTTP 200
bytes 648611216
sha256 65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f
printed 65a87efc4b557caaa0199f09fd398144707c8ffc7eb10e02c30d247e76517c1f

Secrets

Saved-log leak grep for the literal token: 0; positive control (a throwaway copy with the token appended): 1, copy shredded.

Vouch (step 5)

POST /configuration/artifacts (operator Basic auth + X-Felhom-Operator, hub v0.135.0): agent 0.146.1, golden 0.296.0, min_agent 0.131.0, wrapper sha empty → 303 flash=artifacts_set; hub log Artifact manifest set: agent=0.146.1 golden=0.296.0 min_agent="0.131.0" … bundle_sha="42333e96…" (../../audits/hub-safety-2026-10-05/partH/vouch.txt). Per-customer controller floors 0.296.0 for demo-hp, demo-felhom, tester-1; the global floor unchanged (Tester 2 not moved).

Teardown

pct destroy 9100 --purge; shred -u of the token, the runner script and the log in the VM (log copied off first); poweroff; qemu gone (ps -eo comm | grep -c qemu-system-x86 = 0); qemu-img snapshot -a virgin. Host: nothing provisioned.