admin
06727e3228
Part A: hub-config operator_email/operator_enabled (committed earlier); operator + customer email paths proven end-to-end via real Resend sends. Append the "Findings closed" section to the TESTRUN audit (Part A proof, F2-a root cause + deploy fix, F2-b fix + live validation, pending §D supervised reboot) and remove the stale duplicate "Final state" block. REPORT overwritten. hub/CHANGELOG entry. No hub image change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0162BnMpUXscPsUB1cU8Tr6K
45 lines
3.1 KiB
Markdown
45 lines
3.1 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md).
|
|
|
|
## Close the test-run findings — operator email (Part A) + the F2 closures (audit) — 2026-06-30
|
|
|
|
This repo's slice of the "close the TESTRUN findings" task. The agent-side fixes (F2-a, F2-b) ship in
|
|
`felhom-agent` v0.49.0; here it is **Part A (hub config)** + the audit write-up. No hub image change.
|
|
|
|
### Part A — operator email delivery (the previously-unproven hop) — PROVEN end-to-end
|
|
The hub dispatcher's operator path (`Dispatcher.processOperator`) sends only when
|
|
`operatorOn && operatorEmail != ""`; the demo `hub-config` set neither, so the self-health pipeline
|
|
(probe → report → checker → dispatch) stopped one hop short of the inbox. **Fix = config-only:**
|
|
`manifests/hub.yaml` `hub-config` ConfigMap now sets `operator_email: admin@felhom.eu` +
|
|
`operator_enabled: true`. Committed, ArgoCD-synced, hub pod restarted to reload; the mounted config shows
|
|
both (Resend key NOT printed; it stays injected from `Secret/resend-api`). Live tag stays **v0.22.1**.
|
|
|
|
**Proven (both channels):**
|
|
- **Operator:** scratch-denied the new agent `stalelock-unlock` grant → `agent_capability_degraded` →
|
|
`[INFO] Operator email sent for demo-felhom/agent_capability_degraded` (the send-success line that
|
|
never fired while the path was gated off) → restored → `agent_capability_recovered`.
|
|
- **Customer:** `POST /api/v1/notify` (`event_type:test`) → `{"sent":true}` →
|
|
`Notification email sent to nagyfenyvesi.viktor@gmail.com for demo-felhom/test`. Same `sendEmail` →
|
|
Resend the operator path uses.
|
|
|
|
### Audit
|
|
`documentation/audits/TESTRUN-fullstack-2026-06-29.md`: appended the "Findings closed" section (Part A
|
|
proof + F2-a root cause/fix + F2-b fix/live validation + the pending §D supervised reboot) and removed the
|
|
stale duplicate "Final state" block (it showed old versions 0.45.0/0.90.0/0.20.0 and contradicted the real
|
|
parity).
|
|
|
|
### Companion (felhom-agent v0.49.0, for cross-reference)
|
|
- **F2-b:** startup stale-lock recovery (`pct unlock` → delete dangling `vzdump` snapshot → start iff
|
|
onboot, guarded by a no-vzdump-running invariant). Live-validated on `felhom-pve` (recovery on scratch
|
|
9999; invariant guard proven against a REAL in-flight 9201 backup). New narrow grant + Critical capability.
|
|
- **F2-a:** the shared-parent boot script never redeployed because `EnsureSharedParent` gated on the unit
|
|
only; now compares the script too. Root cause confirmed by reproducing the doubling in a `/mnt` scratch
|
|
dir; corrected script is staged on disk (boot-time-only). The peer-group red-proof is the §D supervised
|
|
reboot.
|
|
|
|
### Parity — known-good
|
|
agent **v0.49.0** / controller v0.91.0 / hub v0.22.1 (+ operator-email hub-config); leaf==pin `60b5974d…`;
|
|
caps **46/46**; both drives bound; channel up; apps healthy. Pending the §D supervised reboot: the F2-a
|
|
host-side doubling (corrected script staged; live mount intentionally untouched). No secrets recorded.
|