From 1a642b43e7d2c0710451d0f59d75e6eea68f49c7 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 10 Oct 2026 15:01:48 +0200 Subject: [PATCH] R-896: the volume-persistence gate refuses a host that is not a scratch host (no containers on DooPlex) check() refuses (HARNESS REFUSED, exit 3) before any docker call unless /opt/upg exists (the bench) or FELHOM_SCRATCH_HOST=1. TestVenue red before the guard; new end-to-end decoy. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 13 ++++ CLAUDE.md | 4 +- REPORT.md | 94 +++--------------------- scripts/check-volume-persistence.py | 24 ++++++ scripts/test_check_volume_persistence.py | 60 +++++++++++++++ scripts/test_gate_decoys.py | 6 +- 6 files changed, 113 insertions(+), 88 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 967d845..dcd6bb5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ +## 2026-10-10 (afternoon) — the volume-persistence gate refuses to run on a host that is not a scratch host (R-896) + +**What runs on a box changed:** nothing — a gate script only. + +- **`scripts/check-volume-persistence.py`** builds a canary image and runs every template on the LOCAL Docker. A full + `catalog_gates.py` run on DooPlex (the production host) did exactly that on 2026-10-06. Now `check()` refuses — + `HARNESS REFUSED`, exit 3, before any docker call — unless the host says it is a scratch host: the bench's harness + directory `/opt/upg` exists, or `FELHOM_SCRATCH_HOST=1` is set. Fail closed: no marker, no containers. +- Tests: `TestVenue` (3 cases; the no-marker case was RED before the guard — „the real prober was reached"), and a new + end-to-end decoy in `test_gate_decoys.py` („not a scratch host", rc 3); the three existing end-to-end decoys now set + the marker so they still reach the canary. +- `CLAUDE.md`: the volume-persistence paragraph names the venue rule. + ## 2026-10-10 (later) — Grocy added: household stock, shopping list and chores **What runs on a box changed:** one new app is offered, `kamra.`. Nothing already installed diff --git a/CLAUDE.md b/CLAUDE.md index e9bd376..980610a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -95,7 +95,9 @@ deployed `app.yaml` (customer secrets) is never overwritten. Full deploy details and minutes per app, so it is periodic like the resolvability gate — run it whenever a template's `volumes:` block or image tag changes, and at the start of every catalog campaign, **on a scratch host, never a customer box**. It refuses to report at all unless it has just re-proven itself in - both directions against two canary templates. Fixture tests (no Docker): + both directions against two canary templates — **and, since R-896 (2026-10-10), it refuses (exit 3) before any docker + call unless the host says it is a scratch host: the bench's `/opt/upg` exists, or `FELHOM_SCRATCH_HOST=1` is set.** + So a full `catalog_gates.py` run on DooPlex reports volume-persistence HARNESS REFUSED instead of acting there. Fixture tests (no Docker): `python3 scripts/test_check_volume_persistence.py`. **UNDETERMINED is exit 2 and is never a pass** — an app that wrote nothing has not been shown to be correct. Why it exists: papra mounted `papra_data:/app/data` while the app wrote its database diff --git a/REPORT.md b/REPORT.md index 46ca8c0..1f9cc88 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,87 +1,11 @@ -# REPORT — 2026-10-10: Grocy and LubeLogger published; Monica stopped at the fit check +# REPORT — 2026-10-10 (afternoon): the volume-persistence gate refuses a non-scratch host (R-896) -**What runs on a box changed:** two new apps are offered — `kamra.` (Grocy) and -`garazs.` (LubeLogger). Nothing already installed is touched. **60 template directories, 58 -offered.** Records: `onboarding/grocy.md`, `onboarding/lubelogger.md`, every one of the 61 checks -answered `done` or `n/a`, none `open`. Evidence: -`felhom.eu/documentation/audits/new-apps-2026-10-10/`. +Part of the register-shrink session (`felhom.eu/REPORT-register-shrink-2026-10-10.md`). -## The three apps - -| app | result | what decided it | -|---|---|---| -| **Grocy** 4.7.1 | **published** | MIT, alive (3 releases in 2026), SQLite in one volume, ~30 MiB idle, Hungarian UI 91.6 % | -| **LubeLogger** v1.7.3 | **published** | MIT, very alive (17 releases in 2026), LiteDB in one volume, ~60 MiB idle | -| **Monica** | **stopped — checklist 0.2** | no release of any kind in 17 months, no stable release in 29, the `4.x` branch untouched since 2024-05-04, and an upstream notice that the hosted instance and its data go at the end of December 2026 before a rewrite. **The operator decides** (R-927) | - -## The two faults the walk found, both fixed before publishing - -**1. An `after_install` command may not contain `$`.** The controller runs every element of the command -through Go's `os.Expand` and refuses one that names anything outside `env:`. Grocy's replacement has to -use grocy's own `password_hash(..., PASSWORD_ARGON2ID)`, and PHP is the only interpreter in its image -(measured: no python, no perl, no ruby, no node) — so the code can never be an argument. On 9202 the -first attempt came back - - after_install: [pw argv dsn db i t e s n q h] not declared in env or has no value — not run - -and the app sat behind its install hold with `admin`/`admin` still in place. The code now lives in a -file the compose entrypoint writes and the command passes only `${ADMIN_PASSWORD}`. **Written into -`REUSE.md`'s `after_install` row as a trap** — mealie and dawarich avoid it only by language. - -**2. Grocy could not be updated at all.** The image copies `config-dist.php` to -`/config/data/config.php` *only if that file is absent*, so the file is written once and never follows -the image. A volume written by 4.6.0 and started under 4.7.1 answered **HTTP 500 on every page** — -`Configured AUTH_CLASS "Grocy\Middleware\DefaultAuthMiddleware" does not exist` — while its own log said -the migrations had run and the init was done. The entrypoint now deletes that file at every start, so -the image re-copies its current defaults; every setting a household needs is a `GROCY_*` environment -variable and each person's own choices live in the database. **The edge failed before the fix and is -`proven` after it, on both venues** — and the failure bought something: the product's own guarded Update -was watched undoing a REAL failure (backing-up → pulling → copying → verifying → **undone** in 346 s, -the app back on 4.6.0, the data read back), which is checklist 6.3 without manufacturing a fault. - -## What LubeLogger ships as, and what we ship - -`Middleware/Authen.cs` reads `EnableAuth` with a default of `false`, and `appsettings.json` ships it -false. With it false the middleware **mints a ticket with the `IsRootUser` role for every request**. -Measured on a default start: an anonymous stranger got 200 on `/`, on `/api/vehicles` and on -`/Home/Settings`, and `POST /Vehicle/SaveVehicle` answered `{"success":true}` — the vehicle came back -from the API. Our template's entrypoint exports `EnableAuth=true` and the SHA-256 of a generated name -and password, so the app's own login is on **before its first byte**: measured from the container's -creation, at t+1 s nothing was listening and at t+2 s `/api/vehicles` was already 401. No install -window to close. Sign-up is closed by the app itself (`Invalid Token`). - -## Catalogue conventions added - -- **`REUSE.md` §2, a fifth healthcheck family** — bash `/dev/tcp`, for an image with no HTTP client at - all. `ghcr.io/hargata/lubelogger` has no curl, wget, nc, python or node; it has bash. Measured in both - directions (rc 0 against the app with an HTTP 200 line, rc 1 against a dead port) before it was - written down, with its traps: it needs **bash**, not `sh`, and the connect must sit outside the - pipeline or its failure is invisible. -- **`REUSE.md` `after_install` row** — the `$` trap above, with the way out. - -## The ladders - -| app | step | bench | box 9202 | -|---|---|---|---| -| grocy | 4.6.0 → 4.7.1 | **proven** — soak 605 s, 10343 requests, peak anon 6.7 % of 384 M, 0 kills | **proven** — the product's guarded Update, done in 41 s | -| lubelogger | v1.7.2 → v1.7.3 | **proven** — soak 605 s, 11988 requests, peak anon 12.3 % of 512 M, 0 kills | **proven** — done in 25.6 s | - -Both written by `upgrade-test.py --write-ladder` from the two verdicts, never by hand. - -## Tool fixes made on the way (no rows — fixed here, per the size rule) - -- `scripts/check-onboarding.py` crashed with `UnicodeEncodeError` on a Windows console **while printing - which ids were still open**, so an informative exit 1 arrived as a traceback. Guarded. -- `scripts/upgrade-test.py` used `Path.read_text()`/`write_text()`, which take the platform encoding; on - this workstation the ladder writer put a cp1250 em dash into a template full of Hungarian and the file - stopped being valid UTF-8. All 26 calls now say `encoding="utf-8"`. -- The same console trap in **nineteen** of `felhom.eu`'s gate scripts and in `repo_gates.py` itself, - where it **aborted the whole runner at the first gate**. Guarded there too; `reuse-refs` went from a - traceback to green. Red-proof for the claim that this was not my doing: `test_due_checks_gate.py` - fails the same 5 of 42 with my change reverted. - -## Gates - -`python3 scripts/catalog_gates.py grocy lubelogger` — all twelve green, the two runtime ones included -(`image-resolvable` and `volume-persistence`, run on bench 9401 where there is Docker): -`felhom.eu/documentation/audits/new-apps-2026-10-10/box/*/gates.txt`. +- **Change:** `check-volume-persistence.py` refuses (exit 3, `HARNESS REFUSED`) before any docker call unless the host + is a scratch host (`/opt/upg` present, or `FELHOM_SCRATCH_HOST=1`). DooPlex has neither, so the gate can no longer act + on the production host. +- **Red-proof:** `TestVenue.test_no_marker_refuses_before_any_docker_call` failed before the guard („the real prober was + reached"), passes after. Full suite 61/61; decoys incl. the new „not a scratch host" case all behave; + `catalog_gates.py --fast` rc 0. +- **What runs on a box changed:** nothing. diff --git a/scripts/check-volume-persistence.py b/scripts/check-volume-persistence.py index 7fa9306..41c17ca 100644 --- a/scripts/check-volume-persistence.py +++ b/scripts/check-volume-persistence.py @@ -944,9 +944,33 @@ def collect_apps(root: Path, only=None, include_unavailable=False): # apart, so a summary can say whether the gate ran at all. Pinned by test_check_volume_persistence.py. HARNESS_REFUSED = 3 +# R-896 (2026-10-10): the real prober builds a canary image and runs every template on the LOCAL Docker. Run on DooPlex +# (the production host) it acted there — and its self-test failed for every app. So it runs only where the host says it +# is a scratch host: the bench's layout directory, or an explicit FELHOM_SCRATCH_HOST=1 from the person who knows the box. +# Fail closed: no marker → HARNESS REFUSED before any docker call. Pinned by TestVenue (test_check_volume_persistence.py). +SCRATCH_ENV = "FELHOM_SCRATCH_HOST" +SCRATCH_MARKERS = (Path("/opt/upg"),) # the bench guest's harness layout (upgrade-test.py ROOT) + + +def venue_refusal() -> str: + """Empty when this host may run containers for the gate; otherwise the reason it may not.""" + if os.environ.get(SCRATCH_ENV) == "1": + return "" + if any(m.is_dir() for m in SCRATCH_MARKERS): + return "" + return ("this host is not a scratch host (no %s, %s is not 1) — the gate runs real containers on the local " + "Docker and must not act on a production host (R-896). Run it on the bench, or set %s=1 on a scratch " + "host." % (" / ".join(str(m) for m in SCRATCH_MARKERS), SCRATCH_ENV, SCRATCH_ENV)) + def check(root: Path, only=None, prober=docker_prober, include_unavailable=False, evidence: Path | None = None, skip_self_test=False) -> int: + if prober is docker_prober: + why = venue_refusal() + if why: + print(f"ERROR: {why}", file=sys.stderr) + print("HARNESS REFUSED — not a scratch host; no container was started") + return HARNESS_REFUSED apps, skipped = collect_apps(root, only, include_unavailable) if skipped: print(f"skipping {len(skipped)} app(s) not offered for new installs: {', '.join(skipped)}") diff --git a/scripts/test_check_volume_persistence.py b/scripts/test_check_volume_persistence.py index 4cf9df8..efd0083 100644 --- a/scripts/test_check_volume_persistence.py +++ b/scripts/test_check_volume_persistence.py @@ -9,6 +9,7 @@ Run: python3 scripts/test_check_volume_persistence.py """ import importlib.util import io +import os import sys import tempfile import unittest @@ -597,5 +598,64 @@ class TestEmptyBind(unittest.TestCase): self.assertFalse(any("R-805" in w for w in why), why) +class TestVenue(unittest.TestCase): + """R-896: the REAL prober runs containers on the local Docker. On a host that is not a scratch host (DooPlex is + the production host) the gate refuses BEFORE any docker call — the consequence, not the helper: the prober is + never reached.""" + + def setUp(self): + self._env = os.environ.pop(cvp.SCRATCH_ENV, None) + self._markers = cvp.SCRATCH_MARKERS + self._real = cvp.docker_prober + self.calls = [] + + def tearDown(self): + if self._env is not None: + os.environ[cvp.SCRATCH_ENV] = self._env + else: + os.environ.pop(cvp.SCRATCH_ENV, None) + cvp.SCRATCH_MARKERS = self._markers + + def _run(self): + def spy(*a, **kw): + self.calls.append(a) + raise AssertionError("the real prober was reached") + with tempfile.TemporaryDirectory() as td: + d = Path(td) / "templates" / "demo" + d.mkdir(parents=True) + (d / "docker-compose.yml").write_text("services:\n s:\n image: alpine:3.22\n") + (d / ".felhom.yml").write_text("slug: demo\n") + orig_self_test = cvp.self_test + cvp.self_test = lambda prober: spy() + try: + buf = io.StringIO() + with redirect_stdout(buf): + rc = cvp.check(Path(td)) # the default prober = the real one + finally: + cvp.self_test = orig_self_test + return rc, buf.getvalue() + + def test_no_marker_refuses_before_any_docker_call(self): + with tempfile.TemporaryDirectory() as nowhere: + cvp.SCRATCH_MARKERS = (Path(nowhere) / "absent",) + rc, out = self._run() + self.assertEqual(rc, cvp.HARNESS_REFUSED, out) + self.assertIn("not a scratch host", out) + self.assertEqual(self.calls, []) + + def test_marker_directory_lets_it_run(self): + with tempfile.TemporaryDirectory() as here: + cvp.SCRATCH_MARKERS = (Path(here),) + with self.assertRaises(AssertionError): # it went on to the self-test (the spy) + self._run() + + def test_explicit_env_lets_it_run(self): + with tempfile.TemporaryDirectory() as nowhere: + cvp.SCRATCH_MARKERS = (Path(nowhere) / "absent",) + os.environ[cvp.SCRATCH_ENV] = "1" + with self.assertRaises(AssertionError): + self._run() + + if __name__ == "__main__": unittest.main(verbosity=2) diff --git a/scripts/test_gate_decoys.py b/scripts/test_gate_decoys.py index ff97c79..8738eef 100644 --- a/scripts/test_gate_decoys.py +++ b/scripts/test_gate_decoys.py @@ -876,7 +876,7 @@ def volume_persistence_cases(): empty = os.path.join(ws, "nobin") os.makedirs(empty) - def run(name, expect_rc, must=(), path=stub, templates=True): + def run(name, expect_rc, must=(), path=stub, templates=True, scratch=True): global ran cat = os.path.join(ws, "cat") shutil.rmtree(cat, ignore_errors=True) @@ -889,7 +889,7 @@ def volume_persistence_cases(): "services:\n demo:\n image: example.org/demo:1.0\n volumes:\n - demo_data:/data\n" "volumes:\n demo_data:\n") r = subprocess.run([sys.executable, os.path.join(cat, "scripts", "check-volume-persistence.py")], - cwd=cat, env={"PATH": path}, capture_output=True, text=True, input="", timeout=300) + cwd=cat, env=dict({"PATH": path}, **({"FELHOM_SCRATCH_HOST": "1"} if scratch else {})), capture_output=True, text=True, input="", timeout=300) out = r.stdout + r.stderr ran += 1 miss = [m for m in must if m not in out] @@ -902,6 +902,8 @@ def volume_persistence_cases(): run("LABEL: a runtime that answers nothing", 3, ("HARNESS REFUSED", "failed its canary")) run("LABEL: no docker at all", 3, ("HARNESS REFUSED",), path=empty) run("LABEL: nothing to judge", 3, ("HARNESS REFUSED",), templates=False) + # R-896: a host that does not say it is a scratch host (DooPlex) — refused before the canary is even built. + run("LABEL: not a scratch host", 3, ("HARNESS REFUSED", "not a scratch host"), scratch=False) finally: shutil.rmtree(ws, ignore_errors=True)