REPORT: v0.280.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,16 +1,21 @@
-# REPORT — 2026-09-28 evening: v0.279.0
+# REPORT — v0.280.0: the setup gate (decision 46); "I changed it" (R-710); password fields off the page (R-709); a special-character generator (2026-09-29)
 
-Architecture: `09` §3 decision 45 (new), `07` §6 (Part D), `01` §5. Brief: "no app goes live with a login a stranger knows…".
+Architecture: `felhom.eu/documentation/architecture/09-update-architecture.md` §3 decisions 45–46, `01-topology-and-trust.md`
+§5. Evidence: `felhom.eu/documentation/audits/login-gate-2026-09-29/`. Session report: `felhom.eu/REPORT-login-gate-2026-09-29.md`.
 
-| change | test (red-proof) | live |
+- **Built only after the spike passed** (`B/B-VERDICT.md`). `setup_gate: true` → a fresh install writes
-|---|---|---|
+  `<stacks>/traefik/dynamic/setup-gate-<app>.yml` BEFORE the first start (forwardAuth on every router the app's labels
-| `after_install:` — one command after a FRESH install, generated values filled in, `success:` marker required, recorded in app.yaml; the deploy-done hook now set on every box | `TestAfterInstall_ReplacesTheDefaultLoginOnceAndRecordsIt` (RP13 marker, RP14 empty value), `TestAfterInstall_IsWiredToEveryFreshInstall` | 9202: claper and bookstack — default fails, generated works, wrong fails; claper after a restore keeps it |
+  publish, priority 100000 + rule length); the answerer (`/__felhom_gate/auth`, before the host check) lets through only
-| the page's default-login rule (`defaultLoginInEffect`, `app_info.known_login`) | `TestKnownLogin_InEffectOnlyUntilReplaced` (RP15) | demo-hp: bookstack, calibre-web, romm pages warn; docmost (no default) does not; claper page hides the card after the fix |
+  a host-bound gate cookie, minted after a valid dashboard session on `felhom.<domain>/__gate/start` (60 s one-use token).
-| Part D — running app, copy with no data → digest once/app/tier/day + backup-page sentence | `TestPartD_ARunningAppWithAnEmptyCopyIsAnAlarm` (RP11), `TestPartD_TheBackupPageSaysARunningAppHasNoData` (RP12) | 9202: no false alarm over a full chain |
+  The loop (20 s) opens a gate when `setup_done_probe:` flips; „Kész, beállítottam" opens one without a probe.
-| R-705 — `POST /api/debug/backup/night-chain`; `RunUpdateLegNow` | `TestR705_NightChainRunsTheLegsInOrderAndRefusesWhenBusy` (RP8, RP9), `TestR705_TheManualLegRunsByDay` (RP10) | 9202: 44 s, second press 409, leg deadline 22:00 |
+- **Tests:** stacks `TestSetupGate_*` (9), `TestGenerateValue_PasswordWithASpecialCharacter`; web `TestSetupGate_*` (4),
-| R-706 — removal with backups deletes the verification copy | `TestR706_RemovalWithBackupsDeletesTheVerificationCopy` (RP7) | not seen live |
+  `TestSetupGatePage_*`, `TestKnownLogin_*`, `TestR709_*`. `go build`, `go vet`, `go test ./...` green; controller gates
-
+  green; parity fixtures: 4 new cases, 6 deploy fixtures regenerated (diff = the R-709 lines and the generator only).
-Red-proofs: `felhom.eu/documentation/audits/logins-nvme-2026-09-28/redproofs/` — RP13 first failed to COMPILE (not a
+- **Red-proofs RP1–RP16**, each seen failing on an assertion (`C/redproofs/`).
-proof); rewritten, and the test gained the exit-0-without-marker case, which is claper's real failure shape.
+- **Live on 9202** (drill catalog): immich, n8n, audiobookshelf (probe), uptime-kuma (button) — 0 app answers to a
-Suite green; `controller_gates.py` green (go-parity keys listed, the debug button added, the debug page fixture
+  stranger before each gate opened; the household in 0.2 s; a restart kept a closed gate and the household's pass;
-regenerated — diff = the two button lines). Floor 0.279.0 (MinAgent 0.131.0), both demo boxes healthy.
+  immich's phone-app API unchanged after. mealie, wger, calibre-web: default refused, generated signs in.
+  R-709: the revealed value is not in the settings page. **Delivered:** floor 0.280.0; demo-hp and demo-felhom run it;
+  demo-hp's "I changed it" pressed on bookstack and calibre-web (the operator's ruling).
+- **Not live:** a restore of a gated app (test only; R-648 forbids the whole-box backup a drill would need).
+- MinAgent 0.131.0 (unchanged).