v0.280.0: the setup gate (decision 46); R-710 'I changed it' + absent-record window; R-709 password fields off the page; password:N:special generator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,34 @@
+## v0.280.0 — the setup gate: a new app is closed to strangers until its household set it up; "I changed it"; an installed app's password leaves the page HTML; a generator with a special character (2026-09-29)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `setup_gate.page_title`,
+`setup_gate.page_body`, `setup_gate.sign_in`, `app_info.setup_gate_title`, `app_info.setup_gate_closed`,
+`app_info.setup_gate_probe`, `app_info.setup_gate_button_hint`, `app_info.setup_gate_done_btn`,
+`app_info.default_login_changed_btn`, `err.stacks.setup_gate_failed`, `err.setup_gate.not_closed`,
+`err.setup_gate.open_failed` (hu + en). Evidence: `felhom.eu/documentation/audits/login-gate-2026-09-29/`.
+
+- **The setup gate (`09` §3 decision 46, built after the spike PASSED — `audits/login-gate-2026-09-29/B/B-VERDICT.md`).**
+  A template with `setup_gate: true` is installed CLOSED: before the app's first start the controller writes a traefik
+  file-provider router per app router (same rule, priority 100000 + rule length, `forwardAuth` →
+  `http://felhom-controller:8080/__felhom_gate/auth`, then the app's own `<svc>@docker`). The answerer lets a request
+  through only with a host-only gate cookie; a browser without one goes to `https://felhom.<domain>/__gate/start`,
+  where a valid DASHBOARD session gets a 60-second one-use token bound to the app host, swapped on the app host for
+  the cookie. The dashboard cookie is never widened. A script or a phone app gets 401. The gate OPENS (record first,
+  then the file) when the app's own `setup_done_probe:` says so (read on the docker network every 20 s), or when the
+  household presses „Kész, beállítottam". The record (`setup_gate:` in app.yaml) is a life record: a restart rewrites a
+  missing file, a restore keeps it, a kept-data load never gates. A gate that cannot be written REFUSES the install.
+  The key is persisted (`<data>/setup-gate.key`, 0600): a restart does not re-gate a browser that passed.
+- **R-710:** an app installed before its template gained an `after_install` was never warned about its live default
+  login (an absent record read as "not run yet" for ever — measured on demo-hp's bookstack). An absent record now means
+  "not run yet" only for 30 minutes after the install. And the default-login card has „Megváltoztattam" / "I changed it":
+  the household's word, recorded as `default_login: {changed_at, by}`; the card then goes.
+- **R-709:** an installed app's `type: password` value is no longer written into its settings page; the eye fetches it
+  (`/stacks/<n>/auto-field/reveal`, now also for password fields of an installed app, never for a restore-generated one).
+- **`generate: password:N:special`:** a lower, an upper, a digit and one of `-_.!@#%+=`, a letter or digit first — for
+  an app whose own policy demands it (calibre-web). The install page's „Generálás" button makes the same shape.
+- Tests: `TestSetupGate_*` (stacks + web), `TestSetupGatePage_*`, `TestKnownLogin_*`, `TestR709_*`,
+  `TestGenerateValue_PasswordWithASpecialCharacter`; a `composeExecFn` seam so a deploy test never reaches Docker.
+  Red-proofs RP1–RP16, each seen failing on an assertion (`audits/login-gate-2026-09-29/C/redproofs/`).
+
 ## v0.279.0 — no app goes live with a login a stranger knows (after_install); an empty backup of a running app is an alarm; the night's chain on a button; R-706 (2026-09-28)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged; Part D rides the existing operator-only