admin/app-catalog-felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

New-app checklist: reviewed, a gate (onboarding), the wger pilot record, the existing apps' gap page
gates / gates (push) Successful in 2s
Details

Browse Source 
NEW-APP-CHECKLIST.md: the reviewer's draft reviewed - 60 rows in 10 groups, each with how/why and a since date;
7 rows added, 16 sharpened, 9 wrong claims fixed. onboarding/_TEMPLATE.md (one line per id), onboarding/wger.md
(the pilot, exempt app, 11 open rows each a register row), onboarding/EXISTING-APPS-GAPS.md (read only, from
scripts/onboarding_gaps.py). Gate onboarding (scripts/check-onboarding.py) in --fast: a template directory not
among the 53 published before 2026-10-01 needs a complete record; decoys in test_gate_decoys.py (16 cases, 5 gate
mutants seen red). CLAUDE.md, REUSE.md 5, README point to it. No template changed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-01 15:20:52 +02:00
parent 6d72c091e0
commit dc0ab8b2a8
15 changed files with 1068 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
onboarding/EXISTING-APPS-GAPS.md
+87
View File
@@ -0,0 +1,87 @@
# EXISTING APPS — what the catalog already shows, per checklist group
> Generated by `scripts/onboarding_gaps.py` from committed files (catalog `6d72c09`). **Do not edit by hand.**
> Read only: nothing was re-tested. A cell is what a FILE says, not a measurement made today. The 53 apps
> published before the checklist (2026-10-01) are exempt from the onboarding gate; this page is information,
> not work (operator default 2026-10-01, may be reversed).
## Headline — apps whose files show the group covered (of 53)
| group | covered | what "covered" means here (the signal read) |
|---|---|---|
| 0 Fit | 52 / 53 | `lifecycle` available, `use_cases` and `pi_compatible` present — licence, telemetry, internet need and phone apps are recorded nowhere |
| 1 Images, start command, DB | 53 / 53 | pins clean and the engine rules hold (MariaDB auto-upgrade, PG 18 mount) — entrypoint switches, the production server, migrations and secrets read (1.4–1.9) are recorded for NO app |
| 2 Storage and backup | 38 / 53 | the 2026-08-02 persistence sweep read the app CLEAN, and an HDD app carries `backup:` classes — no restore round trip is recorded per app |
| 3 Accounts and strangers | 39 / 53 | a FIRST-ADMIN.md row whose source is MEASURED on a box — lock-out (3.6) is recorded only for the R-752 apps |
| 4 Health | 49 / 53 | every service has a compose healthcheck, a controller probe exists, the exposed container is named like the stack — no negative control is recorded |
| 5 Resources | 24 / 53 | every service limited, `mem_limit` = the sum, and a ladder entry carries a measured memory watch — no first-start-from-birth watch is recorded except immich's |
| 6 Updates | 26 / 53 | a proven (not backfilled) ladder step AND an upgrade fixture |
| 7 Mail | — | not countable from files: whether an app WANTS mail is not recorded; the mapped count is below |
| 8 Text and listing | 52 / 53 | English block, tagline + use_cases + first_steps, listed in README, a FIRST-ADMIN row |
Mail: 6 app(s) carry `smtp_mapping`.
## Found while computing this page
- `mem_limit` differs from the sum of the compose limits (REUSE.md §2 says equal): 8 — adventurelog (384M vs 896), bookstack (512M vs 768), calcom (768M vs 1792), claper (384M vs 640), kimai (384M vs 640), nextcloud (1024M vs 1664), outline (768M vs 1152), zipline (512M vs 768).
- A service with no memory limit: none.
- A MariaDB sidecar without `MARIADB_AUTO_UPGRADE=1`: none.
- A PostgreSQL 18 data mount at the old path: none.
## Per app
| app | 0 fit | 1 images/DB | 2 storage | 3 accounts | 4 health | 5 resources | 6 updates | 7 mail | 8 text |
|---|---|---|---|---|---|---|---|---|---|
| actualbudget | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate | yes | no watch | 0 proven step(s), fixture | — | yes |
| adventurelog | yes | engine rules hold | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | hc missing | watched 73%, mem_limit≠sum | 1 proven step(s), fixture | — | yes |
| audiobookshelf | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 10% | 1 proven step(s), fixture | — | yes |
| bentopdf | yes | no DB sidecar | sweep undetermined | class 5, read only | yes | no watch | 0 proven step(s), no fixture | — | yes |
| bookstack | yes | engine rules hold | sweep clean | class 3, measured + after_install | yes | watched 44%, mem_limit≠sum | 1 proven step(s), fixture | — | yes |
| calcom | yes | engine rules hold | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | yes | watched 62%, mem_limit≠sum | 1 proven step(s), fixture | smtp mapped | yes |
| calibre-web | yes | no DB sidecar | sweep clean, backup classes | class 3, measured + after_install | yes | watched 19% | 1 proven step(s), fixture | — | yes |
| claper | yes | engine rules hold | sweep undetermined | class 3 (+ open sign-up), measured + after_install | yes | watched 48%, mem_limit≠sum | 1 proven step(s), fixture | — | yes |
| code-server | yes | no DB sidecar | sweep clean | class 1, read only | yes | no watch | 0 proven step(s), fixture | — | yes |
| crafty-controller | yes | no DB sidecar | sweep clean | class 1, read only | yes | watched 3% | 1 proven step(s), fixture | — | yes |
| docmost | yes | engine rules hold | sweep undetermined | class 4, measured + setup_gate | yes | watched 80% | 1 proven step(s), fixture | — | yes |
| emby | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 5% | 2 proven step(s), no fixture | — | yes |
| ghost | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate | yes | watched 27% | 2 proven step(s), no fixture | — | yes |
| gitea | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | yes | watched 27% | 1 proven step(s), fixture | smtp mapped | yes |
| glance | yes | no DB sidecar | sweep undetermined | class 5, read only | yes | no watch | 0 proven step(s), no fixture | — | yes |
| gokapi | yes | no DB sidecar | sweep clean | class 1, read only | yes | no watch | 0 proven step(s), no fixture | — | yes |
| grafana | yes | no DB sidecar | sweep clean | class 1, read only | yes | watched 47% | 1 proven step(s), fixture | — | yes |
| gramps-web | yes | no DB sidecar | sweep broken | class 4, measured + setup_gate/signup_block/after_setup | yes | no watch | 0 proven step(s), fixture | — | yes |
| home-assistant | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate | yes | watched 32% | 1 proven step(s), fixture | — | yes |
| homebox | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | yes | no watch | 0 proven step(s), no fixture | — | yes |
| homepage | yes | no DB sidecar | sweep clean | class 5, read only | yes | no watch | 0 proven step(s), fixture | — | yes |
| immich | yes | engine rules hold | sweep undetermined, backup classes | class 4, measured + setup_gate | probe container not in compose | watched 51% | 2 proven step(s), no fixture | — | yes |
| jellyfin | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | no watch | 0 proven step(s), fixture | — | yes |
| kimai | yes | engine rules hold | sweep clean | class 1, read only | yes | watched 45%, mem_limit≠sum | 2 proven step(s), no fixture | — | yes |
| komga | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 64% | 2 proven step(s), no fixture | — | yes |
| mealie | yes | no DB sidecar | sweep clean | class 3, measured + after_install | yes | watched 23% | 1 proven step(s), fixture | smtp mapped | yes |
| n8n | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate | yes | watched 23% | 3 proven step(s), fixture | — | yes |
| navidrome | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 7% | 2 proven step(s), fixture | — | yes |
| nextcloud | yes | engine rules hold | sweep clean, backup classes | class 1, measured | yes | watched 24%, mem_limit≠sum | 2 proven step(s), fixture | smtp mapped | yes |
| onlyoffice | yes | no DB sidecar | sweep clean | class 5, read only | yes | no watch | 0 proven step(s), fixture | — | yes |
| opengist | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate/signup_block | yes | watched 78% | 1 proven step(s), fixture | — | yes |
| outline | yes | engine rules hold | sweep clean | class 4, measured + setup_gate | yes | watched 34%, mem_limit≠sum | 2 proven step(s), fixture | — | yes |
| paperless-ngx | yes | engine rules hold | sweep clean, backup classes | class 1, read only | probe container not in compose | watched 40% | 1 proven step(s), fixture | — | yes |
| papra | yes | no DB sidecar | sweep broken | class 4, measured + setup_gate/signup_block/after_setup | yes | no watch | 0 proven step(s), fixture | — | yes |
| plant-it | — (abandoned) | no DB sidecar | sweep undetermined | class 4, read only + setup_gate | yes | no watch | 0 proven step(s), no fixture | — | yes |
| plex | yes | no DB sidecar | sweep clean, backup classes | class 2, read only | yes | no watch | 0 proven step(s), fixture | — | yes |
| privatebin | yes | no DB sidecar | sweep broken | class 5, read only | yes | no watch | 0 proven step(s), fixture | — | yes |
| radarr | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | no watch | 0 proven step(s), fixture | — | yes |
| rallly | yes | engine rules hold | sweep clean | class 4, measured + setup_gate | yes | watched 61% | 2 proven step(s), fixture | smtp mapped | yes |
| recipe-importer | yes | no DB sidecar | sweep undetermined | class 4, measured + setup_gate | yes | no watch | 0 proven step(s), no fixture | — | not in README |
| romm | yes | engine rules hold | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 78% | 2 proven step(s), fixture | — | yes |
| seerr | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate | yes | no watch | 0 proven step(s), no fixture | — | yes |
| sonarr | yes | no DB sidecar | sweep clean, backup classes | class 4, measured + setup_gate | yes | watched 14% | 1 proven step(s), no fixture | — | yes |
| sparkyfitness | yes | engine rules hold | sweep undetermined | class 4, measured + setup_gate/signup_block/after_setup | yes | watched 31% | 1 proven step(s), fixture | — | yes |
| tandoor | yes | engine rules hold | sweep clean | class 4, measured + setup_gate | yes | watched 79% | 1 proven step(s), fixture | — | yes |
| termix | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | yes | no watch | 0 proven step(s), fixture | — | yes |
| uptime-kuma | yes | no DB sidecar | sweep undetermined | class 4, measured + setup_gate | yes | watched 43% | 1 proven step(s), fixture | — | yes |
| vaultwarden | yes | no DB sidecar | sweep clean | class 1, read only | yes | no watch | 0 proven step(s), fixture | smtp mapped | yes |
| vikunja | yes | no DB sidecar | sweep clean | class 4, measured + setup_gate/signup_block/after_setup | hc missing | no watch | 0 proven step(s), fixture | — | yes |
| wanderer | yes | no DB sidecar | sweep undetermined | class 4, measured + signup_block/after_setup | yes | no watch | 0 proven step(s), no fixture | — | yes |
| wger | yes | no DB sidecar | sweep clean | class 3, measured + after_install | yes | watched 50% | 1 proven step(s), fixture | — | yes |
| wishlist | yes | no DB sidecar | sweep broken | class 4, measured + setup_gate/signup_block | yes | watched 36% | 1 proven step(s), fixture | — | yes |
| zipline | yes | engine rules hold | sweep undetermined | class 4, measured + setup_gate | yes | watched 34%, mem_limit≠sum | 2 proven step(s), fixture | — | yes |
onboarding/_TEMPLATE.md
+75
View File
@@ -0,0 +1,75 @@
# Onboarding record — <app>
app: <app>
opened: YYYY-MM-DD
template_at: <catalog commit the answers were measured against>
<!--
Copy this file to onboarding/<app>.md, set the three lines above, and answer every row below.
One line per id: `<id> | done | <evidence path(s)>`, `<id> | n/a | <reason, 4+ words>`, `<id> | open | <what is missing>`.
Evidence paths are written from the workspace root (app-catalog-felhom.eu/… or felhom.eu/documentation/audits/…);
several paths are separated by " ; "; a note may follow after " — ". The checks, their "how" and "why":
NEW-APP-CHECKLIST.md. The gate: scripts/check-onboarding.py (catalog_gates.py --fast). Do not reorder or merge
rows; do not add free-form lines between them.
-->
0.1 | open | not started: Open-source licence
0.2 | open | not started: Upstream is alive: a release in the last 6 months, issues answered
0.3 | open | not started: An official image with version tags (not latest only), amd64 (+ arm64 if pi_compatible)
0.4 | open | not started: Telemetry / phone-home
0.5 | open | not started: Needs the internet at runtime (claim tokens, first-start downloads)?
0.6 | open | not started: Needs ports other than HTTP(S)? The tunnel carries HTTP only
0.7 | open | not started: Phone / desktop apps: which login route do they call, and does it work through the …
0.8 | open | not started: What a household gets from it, in one sentence (Hungarian)
0.9 | open | not started: The app does not call ITSELF at its public name (server-side), or the bench override …
1.1 | open | not started: Every image pinned to a concrete tag that resolves
1.2 | open | not started: Database engine and major = what the app's own upstream compose runs
1.3 | open | not started: MariaDB sidecar: MARIADB_AUTO_UPGRADE=1
1.4 | open | not started: The app migrates its own database at start, or the switch that makes it do so is set
1.5 | open | not started: The app runs its production server, not a development server
1.6 | open | not started: Every key and secret the app READS is set or generated
1.7 | open | not started: Every start-time switch in the image's entrypoint is read and decided (migrations, …
1.8 | open | not started: Debug / development mode is OFF on the public origin
1.9 | open | not started: A secret whose loss destroys data or locks people out (it encrypts stored data, or …
2.1 | open | not started: Every path the app writes is mounted
2.2 | open | not started: Where each path lives: named volume (NVMe) / ${HDD_PATH}/appdata / ${USERDATA_PATH}
2.3 | open | not started: Backup class for every HDD path (backup: in .felhom.yml) and what the tier-1 unit holds
2.4 | open | not started: File owner / uid fits the box (PUID/PGID where the image wants them)
2.5 | open | not started: A backup and a restore through the product, data read back
2.6 | open | not started: "Remove with data" and "remove, keep data" both do what they say
2.7 | open | not started: Off-site size for a typical household
2.8 | open | not started: A file the household uploads opens again through the front door
3.1 | open | not started: First-admin class (FIRST-ADMIN.md 1–6), measured, and the household can make its first …
3.2 | open | not started: Known default login → after_install with a generated password (and a generated name, …
3.3 | open | not started: Open first-run screen → setup_gate (+ a probe that flips, measured before and after)
3.4 | open | not started: Open sign-up after the setup → signup_block / after_setup
3.5 | open | not started: The install window: a stranger reaches nothing before the password is replaced
3.6 | open | not started: Lock-out: N wrong passwords by a stranger for the public name
3.7 | open | not started: The household can change its password and add family members
3.8 | open | not started: Secrets pass to commands as arguments, never inside program code
3.9 | open | not started: Sign in the way each client does, through traefik over https: the browser form (with …
4.1 | open | not started: Compose healthcheck of the family the IMAGE has (inspected, one tool per run), …
4.2 | open | not started: The controller probe dials what the compose healthcheck dials
4.3 | open | not started: Healthy within start_period on a cold first start (incl. one-time imports), with no …
4.4 | open | not started: Negative control: a broken app reads unhealthy
4.5 | open | not started: The probe-named container is the stack name
5.1 | open | not started: First start from birth, swap OFF: peak anon, oom_kill = 0
5.2 | open | not started: 10-minute soak under the household's heaviest ordinary act: peak anon < 80 % of the …
5.3 | open | not started: mem_limit in .felhom.yml = the sum of the compose limits, and the header comment says …
5.4 | open | not started: Node/Java apps: does the heap size itself from the limit?
5.5 | open | not started: Pi-compatible (yes/no) and the disk the images pull
6.1 | open | not started: An upgrade fixture: seed + read-back through the app's own front door, negative control
6.2 | open | not started: A first ladder step proven on bench + 9202 (--write-ladder), or "manual only" with the …
6.3 | open | not started: The undo works on a real failure (one forced-fail case)
6.4 | open | not started: files_may_change understood (which files change at start)
6.5 | open | not started: Tag shape is stable upstream (no v dropped, no flavour prefix) and whether the …
7.1 | open | not started: Sends mail? → smtp_mapping + ${VAR:-} compose lines
8.1 | open | not started: Hungarian + English, informal „te", no „kérjük"
8.2 | open | not started: app_info: tagline, use_cases, first_steps, default_creds (if any), add_people
8.3 | open | not started: Logo + screenshots on felhom.eu by slug
8.4 | open | not started: README tables, FIRST-ADMIN row, category, catalog_since
8.5 | open | not started: The website's app count still holds
9.1 | open | not started: python3 scripts/catalog_gates.py <app>
9.2 | open | not started: A fresh install on 9202 from the drill catalog, as a household and as a stranger, …
9.3 | open | not started: Every item above done or n/a-with-reason
9.4 | open | not started: Published to the live catalog in ONE commit with its record
onboarding/wger.md
+75
View File
@@ -0,0 +1,75 @@
# Onboarding record — wger
app: wger
opened: 2026-10-01
template_at: 82fff32 (wger/server:2.7; catalog main 6d72c09 when measured)
<!--
The pilot record (NEW-APP-CHECKLIST.md, Part C of the 2026-10-01 brief), filled for wger AS IT IS NOW. wger is one of the
53 apps published before the checklist, so the gate only shape-checks this file and `open` is allowed here. Every open
row is a register row: R-759 (this record's open rows), R-755 (the dev server), R-762 (no CSS/JS, no photos served),
R-763 (strangers make accounts), R-764 (no mail). The first pass, against the template as it was on 2026-09-29, and the
"would it have caught it" table: felhom.eu/documentation/audits/new-app-checklist-2026-10-01/.
Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template identical to live): C1..C9.
-->
0.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — AGPL-3.0; image pulled from Docker Hub
0.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — 2.7 on 2026-09-03; repo pushed 2026-10-01; 251 open issues
0.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — plain `x.y` tags, amd64 + arm64
0.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt — no start-time sync or download is switched on; no outbound connection at rest; ingredient search can download from wger.de on demand (`DOWNLOAD_INGREDIENTS_FROM=WGER`, not measured)
0.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt — first start runs local migrations only
0.6 | n/a | wger serves only HTTP on port 8000; nothing else is published
0.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — the phone app's route: right 200 + a token that reads the API, wrong 400; wger is not gated (class 3)
0.8 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — tagline + five use_cases
0.9 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json — runs on the bench; SITE_URL builds links only
1.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — image-pins and image-resolvable exit 0
1.2 | n/a | wger keeps SQLite on its own volume, no database sidecar
1.3 | n/a | no MariaDB or PostgreSQL service in this template
1.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — `DJANGO_PERFORM_MIGRATIONS=True`; the 2.6 -> 2.7 step migrated and read back on the box
1.5 | open | the container runs `manage.py runserver` — `WGER_USE_GUNICORN` is not set (R-755; C2)
1.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — of 15 key-like env reads: SECRET_KEY generated, JWT pair made at start (phone route 200), DB password unused by SQLite; the rest belong to features off here (S3, mail, reCAPTCHA, OIDC, PowerSync)
1.7 | open | two entrypoint switches are still undecided: `WGER_USE_GUNICORN` (R-755) and `DJANGO_DEBUG` — unset, so `collectstatic` never runs (R-762; C2, C8)
1.8 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — DEBUG False; an unknown page is a plain 404, no debug page
1.9 | n/a | SECRET_KEY signs sessions and reset links only; the JWT pair lives on the data volume and is backed up with it
2.1 | done | app-catalog-felhom.eu/audits/persistence-sweep-2026-08-02/state/gate.log — wger CLEAN (the two volumes are unchanged since)
2.2 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml — two named volumes (NVMe), no drive path
2.3 | n/a | needs_hdd false: no drive path to classify; the tier-1 unit holds both named volumes
2.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt — the app wrote its DB and a photo as user `wger`
2.5 | open | no backup -> remove -> restore -> read back of wger: the box has no per-app backup press outside an Update (R-648) and wger has no newer step yet (R-759)
2.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C7-remove.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8b-remove-with-data.txt — both choices delete both volumes; for a no-drive app "keep data" keeps only the backups (the page says the app stored no drive data)
2.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C4-seed-photo-size.txt — 4.2 MB + 16 KB after the seed
2.8 | open | an uploaded photo is saved (201, file on the volume) but answers 404 through the front door — nothing serves /media/ (R-762; C4, C8)
3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured
3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused
3.3 | n/a | class 3: a known default login, not an open first-run screen
3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — `ALLOW_REGISTRATION` and `ALLOW_GUEST_USERS` default True (R-763; C8)
3.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — 92 stranger tries from the press: 90 no route, 1 the gate, then refused; never let in
3.6 | done | felhom.eu/documentation/audits/lockouts-2026-10-01/B/B5-wger-fix-5min.txt — only the name tried is locked, 5 min; the second member unaffected (`09` decision 58)
3.7 | open | not measured: changing the password and adding a family member; the template has no `add_people` text (R-759)
3.8 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — the password is `sys.argv[1]`
3.9 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — browser form with https Origin: right 302, wrong refused; phone route right 200, wrong 400
4.1 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — wget to 127.0.0.1:8000, docker healthy
4.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — probe-matches-compose exit 0
4.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — healthy 107 s after the press (image pull included), 0 restarts
4.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C5-negative-control.txt — paused: the controller read `stopped` within 4 s, `running` 40 s after; a probe-only failure (running but wrong) was not built
4.5 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml — `container_name: wger`, the only service
5.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C6-first-start-memory.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C6-wger-mem.csv — from birth, 183 s: peak anon 267 MiB = 69.5 % of 384M, swap 0, oom_kill 0
5.2 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/memory-samples.json — 10 min: peak anon 49.8 %, 0 kills, 0 restarts
5.3 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — mem_limit 384M = the one service's 384M
5.4 | n/a | wger is a Python (Django) app, no self-sizing heap
5.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — pi_compatible true, arm64 published, ~375 MB
6.1 | done | app-catalog-felhom.eu/scripts/upgrade_fixtures_box.py — `Wger`: a weight entry through the login + API, with two negative controls
6.2 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — 2.6 -> 2.7 proven on both venues
6.3 | open | not measured for wger: no forced-fail undo (R-759)
6.4 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json — no mark: no file changed at start
6.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — `x.y` + `x.y.0`, stable 2.1 -> 2.7; pre-releases carry `-dev`/`-alpha` suffixes
7.1 | open | wger has a mail switch (`ENABLE_EMAIL`) and no `smtp_mapping`; its mail goes to the console, so a password-reset mail never leaves the box (R-764; C2)
8.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — copy-i18n exit 0
8.2 | open | not read on 9202's app page this session; `add_people` is absent (R-759)
8.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — wger-logo.png and screenshot-1 answer 200
8.4 | done | app-catalog-felhom.eu/README.md — row `fitness.*`; FIRST-ADMIN row; category home; catalog_since set
8.5 | n/a | wger is an existing app; the count does not change
9.1 | open | the runtime volume-persistence gate was not re-run today (last CLEAN 2026-08-02); the other gates exit 0 (B3) (R-759)
9.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt — fresh installs from the drill catalog, as household and stranger
9.3 | open | 10 other rows stay open; each is a register row (R-755, R-759, R-762, R-763, R-764)
9.4 | n/a | wger is exempt: published 2026-02-15, before the checklist