felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

---

REPORT — Impl-1 Part B: install the guarded-mkfs wrapper (host-install v1.8.0)

Date: 2026-07-01 · Repo: felhom.eu (scripts/ only) · Class: Risky/supervised (paired with the destructive-path change in felhom-agent v0.54.0).

Companion to felhom-agent v0.54.0 (the format-safety foundation). Script-only change: host-install now installs the guarded-mkfs wrapper during agent install so every fresh box gets the safe format path.

1. Baseline → target

script v1.7.0 @ 9e5bbc1 → v1.8.0. Paired with agent v0.54.0 (separate repo, 5209830).

2. What changed

• scripts/felhom-host-install.sh step_agent_install: new step (before the sudoers install) that fetch_raws configs/felhom-mkfs-guarded.sh from Gitea, bash -n-validates it, and install -m0755 -o root -g root → /usr/local/sbin/felhom-mkfs-guarded. Wrapper-before-sudoers so the sudoers (which allowlists only the wrapper) is never installed ahead of the file it names.
• The agent v0.54.0 sudoers (fetched by the same step) drops raw mkfs.* (allowlists only the wrapper) and adds read-only pvs/zpool status -P for the agent's unclaimed-disk guard.
• scripts/CHANGELOG.md, version banner. Commit 7ea36bc on main.
• bash -n + shellcheck clean (0 new warnings; the 2 pre-existing SC2015 in step_verify unchanged).

3. Served-copy version

curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh | grep SCRIPT_VERSION → 1.8.0.

4. Live validation (felhom-pve, agent v0.54.0 deploy)

The two-layer format guard (agent unclaimed-filter + this wrapper) validated on the demo — details in felhom-agent/REPORT.md §5:

• wrapper REFUSES the OS disk /dev/sda and the LVM-PV partition /dev/sda3;
• raw sudo mkfs.ext4 /dev/sda is DENIED (Part B — wildcard removed);
• an unclaimed throwaway /dev/sdd FORMATS (the only real format);
• the agent guard's sudo reads (pvs/lsblk/zpool) all work as the felhom-agent user.

Deploy note: installing the sudoers via a manual scp of the Windows working-copy failed visudo (CRLF line endings); fixed live by CR-stripping. The committed repo file is LF, and the host-install fetch_raw-from-Gitea path serves LF — so the shipped path is unaffected. (Lesson recorded.)

5. NOT yet live-validated / deferred

• A fresh install exercising the new step_agent_install wrapper-install step end-to-end (the demo was repaired in place; a clean box will exercise the fetch+install path — the code is dry-run-safe and mirrors the existing sudoers/unit install).
• Impl-2 (raw-device discovery + registry enrollment + wizard rewiring) and Impl-3 (shared-box operator gate for self-serve format) are the separate follow-up specs.

6. Observations

• The guarded-mkfs wrapper is configs/felhom-mkfs-guarded.sh in the felhom-agent repo (co-located with the sudoers it pairs with); host-install fetches it the same way it fetches the unit/sudoers.