REPORT: v0.281.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,21 +1,17 @@
-# REPORT — v0.280.0: the setup gate (decision 46); "I changed it" (R-710); password fields off the page (R-709); a special-character generator (2026-09-29)
+# REPORT — v0.281.0: "Done" asks the app first; sign-up closed after the first admin (decision 47); R-713 (2026-09-29 afternoon)
 
-Architecture: `felhom.eu/documentation/architecture/09-update-architecture.md` §3 decisions 45–46, `01-topology-and-trust.md`
+Architecture: `felhom.eu/documentation/architecture/09-update-architecture.md` §3 decisions 46–47, `01-topology-and-trust.md`
-§5. Evidence: `felhom.eu/documentation/audits/login-gate-2026-09-29/`. Session report: `felhom.eu/REPORT-login-gate-2026-09-29.md`.
+§5. Evidence: `felhom.eu/documentation/audits/gate-rollout-2026-09-29/`. Session report:
+`felhom.eu/REPORT-gate-rollout-2026-09-29.md`.
 
-- **Built only after the spike passed** (`B/B-VERDICT.md`). `setup_gate: true` → a fresh install writes
+- **The press asks the probe first** (409 while "not done" or unreadable); an app without a probe confirms in the page.
-  `<stacks>/traefik/dynamic/setup-gate-<app>.yml` BEFORE the first start (forwardAuth on every router the app's labels
+  Live: zipline pressed before its setup → 409.
-  publish, priority 100000 + rule length); the answerer (`/__felhom_gate/auth`, before the host check) lets through only
+- **Sign-up block** (`signup_block:`), written when the gate opens and BEFORE the gate comes down (a failed write keeps
-  a host-bound gate cookie, minted after a valid dashboard session on `felhom.<domain>/__gate/start` (60 s one-use token).
+  the gate closed); answered by `/__felhom_gate/signup-closed`; the household's 15-minute window. Live on 9202: 11 apps
-  The loop (20 s) opens a gate when `setup_done_probe:` flips; „Kész, beállítottam" opens one without a probe.
+  refused a stranger with the block; the window let a family member in and closed again. Never on an app this box did
-- **Tests:** stacks `TestSetupGate_*` (9), `TestGenerateValue_PasswordWithASpecialCharacter`; web `TestSetupGate_*` (4),
+  not gate (Part 0; read on both demo boxes after the catalog push).
-  `TestSetupGatePage_*`, `TestKnownLogin_*`, `TestR709_*`. `go build`, `go vet`, `go test ./...` green; controller gates
+- **R-713:** code-bound `after_install` values refused; `${NAME|base64}`. Live: claper with `"` and `#{`.
-  green; parity fixtures: 4 new cases, 6 deploy fixtures regenerated (diff = the R-709 lines and the generator only).
+- Tests: `TestSetupGateButton_*`, `TestSignupBlock_*`, `TestSignupClosed_*`, `TestSetupGatePage_ConfirmAndSignupCard`,
-- **Red-proofs RP1–RP16**, each seen failing on an assertion (`C/redproofs/`).
+  `TestR713_*`; full suite, vet and controller gates green; parity fixtures regenerated for the changed button only.
-- **Live on 9202** (drill catalog): immich, n8n, audiobookshelf (probe), uptime-kuma (button) — 0 app answers to a
+  Red-proofs RP17–RP24, each seen failing on an assertion (RP22 re-run after its first mutation did not compile).
-  stranger before each gate opened; the household in 0.2 s; a restart kept a closed gate and the household's pass;
+- Delivered: floor 0.281.0; both demo boxes run it. MinAgent 0.131.0 (unchanged).
-  immich's phone-app API unchanged after. mealie, wger, calibre-web: default refused, generated signs in.
-  R-709: the revealed value is not in the settings page. **Delivered:** floor 0.280.0; demo-hp and demo-felhom run it;
-  demo-hp's "I changed it" pressed on bookstack and calibre-web (the operator's ruling).
-- **Not live:** a restore of a gated app (test only; R-648 forbids the whole-box backup a drill would need).
-- MinAgent 0.131.0 (unchanged).