admin 9fc705209d outline fixture: read Outline 1.10's __Host-csrfToken cookie (R-744) ...

Outline 1.10 names the CSRF cookie __Host-csrfToken on a secure request and csrfToken over plain HTTP (server/utils/
csrf.ts getCookieName); 1.9.1 always said csrfToken. Proven on 9202 at the live pin 1.10.1: installation.create 302,
cookie __Host-csrfToken, apiKeys.create, a published document read back, unknown id and wrong key refused
(felhom.eu/documentation/audits/rulings-2026-10-01/D/D2-outline-fixture-9202.txt). The old pattern cannot match that
header line (the red: 2026-09-30, both venues).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-01 08:19:19 +02:00

..

copy_freeze

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

box_walk.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

catalog_gates.py

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

check-catalog-since.py

catalog-since gate: an image: move must bump the app's catalog_since (R-452) — hook-enforced, shallow CI skips out loud

2026-09-13 19:42:13 +02:00

check-copy-i18n.py

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

check-engine-major.py

harness v4 converts a PostgreSQL major; the engine-major gate passes one proven, marked app (09 decision 35)

2026-09-25 13:04:01 +02:00

check-image-pins.py

image pinning: eliminate :latest from all 5 unpinned templates + standing gate

2026-07-12 14:37:57 +02:00

check-image-resolvable.py

catalog: lifecycle field replaces the retired/ directory move

2026-07-21 16:19:49 +02:00

check-probe-matches-compose.py

probe target: explicit container for paperless-ngx and immich; ambiguity refused (R-630)

2026-09-22 20:28:40 +02:00

check-probe-measured.py

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

check-test-record-move.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

check-test-record.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

check-volume-persistence.py

harness: five new front-door fixtures, gitea's installer, HTTPS backends, per-file change names (R-462, R-624, R-735)

2026-09-30 18:16:45 +02:00

generate-customer.sh

catalog: repoint HDD_PATH defaults/placeholders to /mnt/felhom-drives/<name>

2026-06-15 16:48:52 +02:00

image_digest.py

image_digest.resolve honours a @digest: asks the registry for THAT manifest (R-746)

2026-10-01 07:54:39 +02:00

ladder_backfill.py

test record: an image move must carry its proof (09 decision 13, part 4)

2026-09-23 20:52:32 +02:00

ladder.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

retest_box.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

retest-floating.py

retest-floating: check what the bench brings (docker, python3), not what the sync puts there (R-749)

2026-10-01 07:17:49 +02:00

steps_backfill.py

steps/ per ladder step: gate rule 4, writer, backfill (8); R-653, R-656; decoy suite reads live pins (R-663)

2026-09-24 07:57:51 +02:00

steps_meta_backfill.py

steps/<key>.felhom.yml: gate rule 4b, writer, backfill (8) (R-664)

2026-09-24 11:45:34 +02:00

test_catalog_gates.py

harness: five new front-door fixtures, gitea's installer, HTTPS backends, per-file change names (R-462, R-624, R-735)

2026-09-30 18:16:45 +02:00

test_check_image_resolvable.py

catalog: lifecycle field replaces the retired/ directory move

2026-07-21 16:19:49 +02:00

test_check_volume_persistence.py

harness: five new front-door fixtures, gitea's installer, HTTPS backends, per-file change names (R-462, R-624, R-735)

2026-09-30 18:16:45 +02:00

test_gate_decoys.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

test_image_digest.py

image_digest.resolve honours a @digest: asks the registry for THAT manifest (R-746)

2026-10-01 07:54:39 +02:00

test_ladder_writer.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00

test_pg_conversion.py

harness v4 converts a PostgreSQL major; the engine-major gate passes one proven, marked app (09 decision 35)

2026-09-25 13:04:01 +02:00

test_upgrade_bench.py

harness: five new front-door fixtures, gitea's installer, HTTPS backends, per-file change names (R-462, R-624, R-735)

2026-09-30 18:16:45 +02:00

upgrade_boxport.py

harness: five new front-door fixtures, gitea's installer, HTTPS backends, per-file change names (R-462, R-624, R-735)

2026-09-30 18:16:45 +02:00

upgrade_fixtures_box28.py

Fixtures: sparkyfitness, rallly and outline seed through their own front door (R-462, R-624)

2026-09-30 12:53:35 +02:00

upgrade_fixtures_box.py

outline fixture: read Outline 1.10's __Host-csrfToken cookie (R-744)

2026-10-01 08:19:19 +02:00

upgrade_fixtures.py

upgrade-test: watch memory after the readback (harness v2, R-635/R-462)

2026-09-23 08:54:53 +02:00

upgrade-test.py

Same-tag security fixes as tested steps (09 decision 52, R-740): re-test entries, their gates, the monthly command

2026-09-30 23:06:09 +02:00