diff --git a/CONTEXT.md b/CONTEXT.md index 876cda2..2d11e4b 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -7,7 +7,14 @@ > > Ask Claude Code: "Please update CONTEXT.md with what we did today" -Last updated: 2026-10-01 night (v0.286.1 — the box tells visitors apart, R-753 / decision 63; R-772; R-773) +Last updated: 2026-10-02 (v0.287.0 — the family gate, decisions 63/64, R-780) + +> **2026-10-02 — v0.287.0 (floored, golden 0.287.0 vouched): the family gate.** `internal/family` (members, sessions asked +> on every request), `stacks/family_gate.go` (door before the first start; anchored exceptions; record at install and at a +> removed app's restore; `min_controller`), `web/family_gate.go` (forwardAuth, `/__family/*`, the Család card). The family +> cookie is never accepted by RequireAuth. Rules for later work: a family door is never removed while the app is +> installed; an exception is a literal prefix, anchored; never an exception on an app with no login. Live proof +> `felhom.eu/documentation/audits/family-gate-2026-10-02/A/items.txt`. Catalog: Grimmory + MeTube published behind it. > **2026-10-01 night — v0.286.0 (9202 only) → v0.286.1 (floored, golden 0.286.1 vouched).** Operator ruling `09` §3 > decision 63: extend the box's own gate; first the box tells visitors apart (R-753). `internal/infra`: `felhom-tunnel` diff --git a/REPORT.md b/REPORT.md index b71173a..f2dd796 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,35 +1,31 @@ -# REPORT — v0.286.1: the box tells visitors apart (R-753, decision 63); R-772; R-773 — 2026-10-01 (night) +# REPORT — v0.287.0: the family gate (decisions 63/64, R-780) — 2026-10-02 -Full session report: `felhom.eu/REPORT-visitors-2026-10-01.md`. Evidence: `felhom.eu/documentation/audits/visitors-2026-10-01/` -(A = visitors apart, D = R-772/R-773, E = rollout). Architecture read: `01-topology-and-trust.md` §5/§7, `09` §3 decisions -45–49, 57–63. +Full session report: `felhom.eu/REPORT-family-gate-2026-10-02.md`. Evidence: `felhom.eu/documentation/audits/family-gate-2026-10-02/` +(A = the controller live on 9202, B = the catalog apps on 9202, B4 = a demo box, E = the floor). Architecture read: +`01-topology-and-trust.md` §5 (now with the family gate paragraph), `09` §3 decisions 46, 47, 63, 64. -## Baselines -controller `c1b123c64955` (v0.285.0) → `a28155f` (v0.286.1). Agent unchanged (0.138.0; MinAgent 0.131.0). +## What shipped (v0.287.0, commits 977665d + c8d5ee2) -## Commits -`1e8d045` R-753 · `b53721d` R-772 · `1e216d3` R-773 · `d416742` v0.286.0 CHANGELOG/README · `79ef715` R-772 order fix -(found live) · `a28155f` v0.286.1 CHANGELOG. +- **`internal/family`** — the household's family members: own name + password each (4×4 letters, shown once, bcrypt in + `family.json` 0600), sessions of 30 days, asked on EVERY request (`Valid`), so reset / remove / logout end access at + the next request. A wrong name costs the same bcrypt time as a right one. +- **`internal/stacks/family_gate.go`** — a template's `family_gate: true` gets a traefik forwardAuth door per router, + written BEFORE the first start (an app is never published open); `family_gate_except:` literal prefixes become + routers without the door, anchored `^/prefix(/|$)` (finding F1); the record is written at install and at a removed + app's restore; the tick rewrites/removes the files. `min_controller:` refuses a template that needs a newer box. +- **`internal/web/family_gate.go`** — `/__felhom_gate/family` (forwardAuth), `/__family/start|login|logout` on the + dashboard host; the family cookie (`Path=/__family`) is NEVER accepted by RequireAuth; the sign-in locks per visitor + (5/min, via `rateKey`, R-753) and per name (10/10 min). The Család card (Settings → Security): add / new password / + remove, password once, `no-store`. hu + en, informal „te", no „kérjük"; parity green. -## Tests and red-proofs -Full suite green (`go build/vet/test ./...`, rc 0) before each build; controller gates green (go-parity after the three -new keys were registered). Red-proofs, each seen FAILING on the mutant: RP-A1 (leftmost hop), RP-A2 (the tunnel hop as -the key), RP-A3 (no reconcile of a running traefik), RP-D1 (no-container record healthy), RP-D1b (the 0.286.0 order), -RP-D2 (no lock on a restore) — files under `audits/visitors-2026-10-01/{A,D}/RP-*`. +## Proof -## Live -- **9202 (0.286.0, then 0.286.1, hand-set):** simulated tunnel — a stranger's 5 wrong dashboard logins with a rotating - forged leftmost address locked only him; the household from another address in at once; LAN/impostor forgeries - counted as themselves. R-772: a stopped probe container read `healthy false, not_checked true` 14 s later (0.286.1). - R-773: Karakeep removed + restored → `opened_by: restore`, stranger `/signup` 403 and `users.create` 403, data back. -- **Both demo boxes (floor 0.286.1, min_agent 0.131.0):** each made `felhom-tunnel`, wrote the clean-up file, recreated - traefik and moved cloudflared to `.2` by itself (~5 s). demo-hp's REAL tunnel: an app sees - `6.6.6.6,37.191.56.193, 172.16.253.2`; `X-Forwarded-Host` forged → gone; the dashboard counter keyed on - `37.191.56.193`, locked after 5. Every demo-hp app answers through the tunnel. **ep0's one request was refused by - Cloudflare's edge (403) before the box** — the second outside address is unmeasured on the real tunnel (R-779). -- **Golden 0.286.1** baked, round-tripped, vouched (golden 0.286.1 / agent 0.138.0 / min_agent 0.131.0); the hub then - refused golden 0.285.0 (R-120). `felhom.eu/documentation/tests/golden-0.286.1-2026-10-01/`. - -## NOT validated live -- The app page's "not checked" line (render test only); R-773 on a block-only app (opengist/wishlist — same code path). -- A box rolling back below 0.286 with the new traefik (R-778, reasoned). +- Tests: `internal/family/family_test.go`, `internal/stacks/family_gate_test.go`, `internal/web/family_gate_test.go`. + **Red-proofs RP-F1..F7** (each mutant made its named test fail, then reverted): `A/RP-F-family-gate-mutants.txt`. + Full suite rc 0; `controller_gates.py` OK. +- **Live on 9202 through the product** (`A/items.txt`): a stranger 0 app answers of 36 (LAN + simulated tunnel); members + in with their own logins, the websocket 101; reset/remove/logout end access at once; a stranger's 7 guesses locked + only the stranger; each Grimmory exception kept Grimmory's own login and the look-alikes stayed gated; the controller + down → 500, never the app; the gate's own cost 0.49 ms median. Survived an Update and a remove + restore (`B/box/`). +- **Floor 0.287.0** (min_agent 0.131.0): both demo boxes on 0.287.0 in ~25 s (`E/floor.txt`). **Golden 0.287.0** baked, + round-tripped, vouched (`felhom.eu/documentation/tests/golden-0.287.0-2026-10-02/`).