From 39bf56298dc0a802591df4d11b5f70093efc5462 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 16 Oct 2026 12:38:10 +0200 Subject: [PATCH] v0.319.0 released: REPORT, CONTEXT; CHANGELOG MinAgent 0.158.1 (the floor's, carried from 0.318.0) Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb --- CHANGELOG.md | 3 +- CONTEXT.md | 11 ++++- REPORT.md | 120 ++++++++++++++++++++++++++++++++++++++------------- 3 files changed, 101 insertions(+), 33 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c095d6d..20ffd44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ ## v0.319.0 — the app page in panels, the login in one place, a password the box never had is said in words (2026-10-16) -**MinAgent: 0.157.0** — unchanged; nothing here calls the agent. No golden (`09` §3 decision 250). Design: felhom.eu +**MinAgent: 0.158.1** — the floor's, carried from v0.318.0 (the operator set it there: agent 0.158.0 is superseded by the +security review of its format wrapper). Nothing here calls the agent. No golden (`09` §3 decision 250). Design: felhom.eu `architecture/02-controller-module-map.md` „The app page" (`[DESIGN]`, operator-approved 2026-10-16, section style A). - **Panels (style A).** The hero, the tab bar and every section of the four tabs are panels on `--bg-1`, the column's diff --git a/CONTEXT.md b/CONTEXT.md index fd75f1c..5b96c4b 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -7,7 +7,16 @@ > > Ask Claude Code: "Please update CONTEXT.md with what we did today" -Last updated: 2026-10-16 (v0.318.0 — storage identity build B: the internal data place, partitions, R-1082, R-1084) +Last updated: 2026-10-16 (v0.319.0 — app page tuning round 2: panels, the login panel, the empty-value rule) + +> **2026-10-16 — v0.319.0 RELEASED by CC; the global floor 0.319.0 / MinAgent 0.158.1.** App page style A (operator +> 2026-10-16): the hero, the tab bar and every section are panels on `--bg-1`; the install page's form groups use the same +> rule. „Belépés az alkalmazásba" pairs a `type: password` field with its `*_USER/_USERNAME/_EMAIL` name +> (`web/app_login.go`); a field the box holds no value for is a sentence, never an eye — page and reveal endpoint share +> `storedValuePresent`. Measured cause on demo-hp: Calibre-Web installed 2026-08-21, `ADMIN_PASSWORD` entered its template +> 2026-09-29, and `InjectMissingFields` never fills a `type: password` field; its stored user name is real (renamed in the +> app on 2026-10-01). The settings tab no longer renders `app_deploy_fields`; `/apps/{slug}/install` for an installed app +> still does (R-1095). Evidence: felhom.eu `audits/app-page-tuning-2026-10-16/`. > **2026-10-16 — v0.318.0 RELEASED; the global floor 0.318.0 / MinAgent 0.158.1 (set by the operator).** The internal data > place („Belső tárhely", agent ≥ 0.158.1 reports kind `internal`): bound on one drive-gate tick, registered on the next as diff --git a/REPORT.md b/REPORT.md index c1b41a4..a1db23e 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,42 +1,100 @@ -# REPORT — v0.318.0: the internal data place, partitions, an honest whole-box backup offer, sys_drive never offered (2026-10-16) +# REPORT — v0.319.0: the app page in panels, the login in one place, a password the box never had is said in words (2026-10-16) -Written in ASD-STE100 Simplified Technical English. Design read first: felhom.eu `architecture/16-storage-physical-identity.md` -(§4–§6, §9, §13), `07-backup-architecture.md` §6, `09-update-architecture.md` (MinAgent). Task: storage identity build B -(operator rulings D3–D5; sizes ruled 2026-10-16). Agent counterpart: felhom-agent v0.158.1. +Written in ASD-STE100 Simplified Technical English. Task: „app page tuning, round 2" (operator brief, section style **A**). +Design read first: felhom.eu `architecture/02-controller-module-map.md` „The app page" (now updated, `[DESIGN]`, +operator-approved 2026-10-16). Evidence: felhom.eu `documentation/audits/app-page-tuning-2026-10-16/`. -## 1. Baselines +## 1. Plain words first -controller `123d2d5` (v0.317.0) → `a43d042` + `36da408` = v0.318.0. MinAgent **0.157.0** (no new agent endpoint; the internal -place and the partitions appear only when agent ≥ 0.158.1 reports them). +- **Why the Calibre-Web password was empty (Part 0, measured on demo-hp).** Calibre-Web was installed on 2026-08-21. Its + template got the password field on 2026-09-29. The box adds new generated values to installed apps, but never a + `type: password` value. So the box never had one. The user name the box shows IS the real one: a session renamed the + app's admin to it on 2026-10-01. So nothing was removed from demo-hp. +- **The page now:** the header, the tab bar and every section are panels. The open tab is filled and underlined. + One „Belépés az alkalmazásba" panel shows the name and the password side by side. If the box has no value, the page + says so in a sentence. It never shows an eye that fails. +- **Other boxes:** the hub lists Calibre-Web telemetry from demo-hp and demo-felhom only. On demo-felhom it is not installed + now (checked on the box). No customer box has this state. -## 2. What changed +## 2. Baselines and commits -- `web/internal_place.go`: an agent row of kind `internal` → GuestAttach on one tick, register on the next (kind internal, - default when the household has none, label in the box's language); `refuseInternalLifecycle` on eject/decommission/wipe. -- `web/backup_target_offer.go` (R-1084): `offerRelationFor` — proven different → the promise; unproven → `backup.target.offer_unproven`; - same disk → no offer; older agent → today's offer. The internal place is never offered. -- `web/attach_sources.go` (R-1082): `withoutSystemVolume` hides the system data volume by device. -- `web/agent_disk_handlers.go`, `storage_handlers.go`, templates: partitions in the wizards; a disk with a registered part offers - only its free parts (format only `formattable`, use only filesystem parts); `deviceBacksRegistered` refuses the whole disk (409). -- Locales: `storage.belso_tarhely`, `storage.belso_tarhely_magyarazat`, `storage_wizard.resz_n`, `err.web.belso_tarhely_eletciklus`, - `err.web.meghajto_hasznalatban_formazas`, `backup.target.offer_unproven`. +controller `8d44416` (v0.318.0) → `d170a2a` (the work) → `7adbbb1` (export panel title and inputs, seen in the browser) +→ `0f82eba` (16px under the hero on the install page) → this docs commit. Built from a clean clone at `0f82eba` with that +clone's own `build.sh`: test images `0.319.0-rc.1..rc.3` (demo-hp only), release **0.319.0**. -## 3. Tests and red-proofs +## 3. What changed -internal_place_test.go (5), stacks d4 (a media app's HDD_PATH lands on the internal place; the folder is never created so no -compose can run), r1084_offer_identity_test.go (6), r1082_sysdrive_hidden_test.go (3), partitions_test.go (5). Each was seen -failing by a compiling mutation (a non-compiling mutation was once read as „not caught" and redone). Four i18n parity -fixtures refreshed (diff = only the new lines). `go test ./...` and `controller_gates.py --fast`: green. +- `web/app_login.go` (new): `loginFieldIndexes` (a `type: password` field plus the `secret`/`text` field with the same + prefix and `USER`/`USERNAME`/`EMAIL`), `appLoginFields`, `appSettingRows`, `storedValuePresent`. +- `web/handlers.go`: `deployPageData` gives the tab `LoginFields`, `SettingsRows`, `CurrentHDDLabel`; the reveal + handler's 404 branch uses `storedValuePresent`. +- `app_settings.html`: the login panel; „Cím és kulcsok" as rows (hint under the title, „Tárhely" row, other answers and + keys as rows); no `app_deploy_fields`, no `deploy-container` (700px) wrapper; every block an `.app-section`. +- `app_data.html`, `app_guide.html`, `app_logs.html`: every block an `.app-section` (screenshots hide their panel when none + loads; export title „Exportálás", inputs in the dashboard style). +- `style.css`: style A panels; the install page's `.form-section` and progress panel share the rule. +- `app_fields.html`: header comment only (the install page is byte-identical). +- Locales: `app_page.login_title`, `login_desc`, `login_no_password`, `login_no_name`, `value_no`; `app_export.exportalas` + is now „Exportálás" / "Export". -## 4. Live proof +**Pairs (computed by the Go code over the catalog):** calibre-web, kimai (ADMIN_EMAIL), lubelogger, nextcloud, +paperless-ngx, radicale. The other 14 password apps show the password alone. -Method: endpoint level (the dashboard requests) on a fresh one-disk scratch VM (512 GB, installer 1.33.0, golden 0.318.0): -the internal place registered as the default drive by itself; Jellyfin deployed with DOMAIN + SUBDOMAIN only → 202, healthy, -`/media` on the place; partitions: part 1 formatted, part 2 used, the whole disk refused (409); the backup offer on a VM -without the disk-failure promise; the attach list without `/mnt/sys_drive`. Tester 1, demo-hp and the N100 run 0.318.0 by the -floor. Evidence: felhom.eu `audits/storage-identity-buildB-2026-10-15/live/`. +## 4. Tests and red-proofs -## 11. Observations +New, each seen failing by a compiling mutation, then reverted: +- `TestAppPage_LoginPairPanel` — pairing loop dropped → fails (name missing). +- `TestAppPage_NoStoredValueShowsSentence` — `Stored: true` always → fails (eye offered, endpoint 404). +- `TestAppPage_SettingsHasNoDuplicateDomain` — install form back in the tab → fails (Domain, deploy-form, HDD_PATH). +- `TestAppPage_OneSectionStyleEverywhere` — logs tab on old markup → fails. +- `TestDeployPage_DeployedSelectShowsStoredHDDPath` (re-targeted to the row) — row reads the default drive → fails. -1. FILED: R-1094 — the whole-disk refusal sentence says „Csak a szabad részét formázhatod", untrue while another part is mounted. -2. FILED: R-1093 — an empty part asks for the typed confirmation (the agent's probe reads the parent's partition table). +**Caught by an old test during the work:** removing the deployed-only branches of `app_fields.html` would have put an +installed app's secret into `/apps/{slug}/install` (that address still answers for an installed app). +`TestDeployPage_DeployedApp_DoesNotCarryTheSecret` failed; the branches were restored and two parity cases now render +them (R-1095 filed for the route). + +**Parity fixtures:** 36 app-page fixtures re-captured (the per-task exception): `app_settings_*` (22), `app_data_*` (9), +`app_guide_*` (4), `app_logs`. New: `app_settings_login_not_stored`, `app_settings_login_text_name`, `deploy_installed`, +`deploy_installed_restored`. Every `deploy_new*` fixture and every other fixture byte-identical. +`go test ./...` rc=0 and `controller_gates.py --fast` green before each commit. + +## 5. Live validation + +- **Browser:** headless Chrome (`chrome-headless-shell` on DooPlex, driven over the DevTools protocol by a small script) + through `https://felhom.enkisfelhom.hu`, signed in through the real login form. Calibre-Web and Paperless, four tabs + each, plus the Grocy install page. Measured: active tab `--bg-2` + 2px `--blue-bright`; hero, tab bar, sections + `--bg-1`; section padding 18px/24px, 16px apart; every section 820px = the column (logs: 966 = the wide column); + login pair two columns, one column at 390px, no side scroll. Console: clean, except one 404 for a screenshot file the + catalog does not have (the panel hides it; see §7). Screenshots: `audits/app-page-tuning-2026-10-16/browser/`, before: + `…/before/`. +- **Release:** per-customer floors 0.319.0 on Tester 1, demo-hp, demo-felhom (303 `floor_set`); all three ran 0.319.0 at + 10:34 UTC, the image file written by the update path. Box walk checks green on all three: https-only (`https_only_check.py` + rc 0), 0 unhealthy / restarting / exited / created containers, controller healthy, dashboards 200. Global floor + 0.319.0 at 10:35:57 UTC, per-customer floors cleared, read back from the hub DB with its WAL. + +## 6. One slip of my own + +I first saved the global floor with MinAgent **0.157.0**. The floor before it (0.318.0) carried **0.158.1**, set by the +operator because agent 0.158.0's format wrapper is superseded. I re-saved 0.319.0 / **0.158.1** at 10:37:02 UTC (read +back: `0.319.0=0.158.1`). For 65 seconds the declared MinAgent was lower. No box runs agent 0.158.0 (the hub's hosts: +three on 0.158.1, Tester 2 on 0.142.0 and held), so no box changed. The CHANGELOG header now says 0.158.1. + +## 7. Observations + +1. `/apps/{slug}/install` answers for an INSTALLED app with the install form read-only. + FILED: R-1095 +2. The hub's per-app „Deployments 2" counts telemetry history (demo-felhom no longer has Calibre-Web). + NOT-A-FINDING: the page labels it telemetry; the box was checked directly. +3. `InjectMissingFields` never fills a new `type: password` field for an installed app. + NOT-A-FINDING: inventing a login the app never got is R-757's defect; the page now says it in words. +4. The guide asks for three screenshots; Calibre-Web has two, so the browser logs one 404. + NOT-A-FINDING: designed graceful hiding, unchanged. +5. The data tab's „2. mentés" status grid uses the mono font for values and wraps long text. + NOT-A-FINDING: unchanged markup, outside this brief. + +## 8. Teardown + +Machine: demo-hp guest 9201 runs 0.319.0 (was 0.318.0 → rc.1..rc.3 by hand, Tier 0); the Part 0 scripts were deleted +from the host and the guest. Host: nothing provisioned. Hub: the per-customer floors are cleared; the global floor is +0.319.0 / 0.158.1. The test tags `0.319.0-rc.1..3` stay in the registry (an rc is never offered to a household).