v0.287.0: REPORT + CONTEXT (the family gate live on 9202, floored, golden 0.287.0 vouched)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,14 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-01 night (v0.286.1 — the box tells visitors apart, R-753 / decision 63; R-772; R-773)
+Last updated: 2026-10-02 (v0.287.0 — the family gate, decisions 63/64, R-780)
+
+> **2026-10-02 — v0.287.0 (floored, golden 0.287.0 vouched): the family gate.** `internal/family` (members, sessions asked
+> on every request), `stacks/family_gate.go` (door before the first start; anchored exceptions; record at install and at a
+> removed app's restore; `min_controller`), `web/family_gate.go` (forwardAuth, `/__family/*`, the Család card). The family
+> cookie is never accepted by RequireAuth. Rules for later work: a family door is never removed while the app is
+> installed; an exception is a literal prefix, anchored; never an exception on an app with no login. Live proof
+> `felhom.eu/documentation/audits/family-gate-2026-10-02/A/items.txt`. Catalog: Grimmory + MeTube published behind it.
 
 > **2026-10-01 night — v0.286.0 (9202 only) → v0.286.1 (floored, golden 0.286.1 vouched).** Operator ruling `09` §3
 > decision 63: extend the box's own gate; first the box tells visitors apart (R-753). `internal/infra`: `felhom-tunnel`

REPORT.md

@@ -1,35 +1,31 @@
-# REPORT — v0.286.1: the box tells visitors apart (R-753, decision 63); R-772; R-773 — 2026-10-01 (night)
+# REPORT — v0.287.0: the family gate (decisions 63/64, R-780) — 2026-10-02
 
-Full session report: `felhom.eu/REPORT-visitors-2026-10-01.md`. Evidence: `felhom.eu/documentation/audits/visitors-2026-10-01/`
+Full session report: `felhom.eu/REPORT-family-gate-2026-10-02.md`. Evidence: `felhom.eu/documentation/audits/family-gate-2026-10-02/`
-(A = visitors apart, D = R-772/R-773, E = rollout). Architecture read: `01-topology-and-trust.md` §5/§7, `09` §3 decisions
+(A = the controller live on 9202, B = the catalog apps on 9202, B4 = a demo box, E = the floor). Architecture read:
-45–49, 57–63.
+`01-topology-and-trust.md` §5 (now with the family gate paragraph), `09` §3 decisions 46, 47, 63, 64.
 
-## Baselines
+## What shipped (v0.287.0, commits 977665d + c8d5ee2)
-controller `c1b123c64955` (v0.285.0) → `a28155f` (v0.286.1). Agent unchanged (0.138.0; MinAgent 0.131.0).
 
-## Commits
+- **`internal/family`** — the household's family members: own name + password each (4×4 letters, shown once, bcrypt in
-`1e8d045` R-753 · `b53721d` R-772 · `1e216d3` R-773 · `d416742` v0.286.0 CHANGELOG/README · `79ef715` R-772 order fix
+  `family.json` 0600), sessions of 30 days, asked on EVERY request (`Valid`), so reset / remove / logout end access at
-(found live) · `a28155f` v0.286.1 CHANGELOG.
+  the next request. A wrong name costs the same bcrypt time as a right one.
+- **`internal/stacks/family_gate.go`** — a template's `family_gate: true` gets a traefik forwardAuth door per router,
+  written BEFORE the first start (an app is never published open); `family_gate_except:` literal prefixes become
+  routers without the door, anchored `^/prefix(/|$)` (finding F1); the record is written at install and at a removed
+  app's restore; the tick rewrites/removes the files. `min_controller:` refuses a template that needs a newer box.
+- **`internal/web/family_gate.go`** — `/__felhom_gate/family` (forwardAuth), `/__family/start|login|logout` on the
+  dashboard host; the family cookie (`Path=/__family`) is NEVER accepted by RequireAuth; the sign-in locks per visitor
+  (5/min, via `rateKey`, R-753) and per name (10/10 min). The Család card (Settings → Security): add / new password /
+  remove, password once, `no-store`. hu + en, informal „te", no „kérjük"; parity green.
 
-## Tests and red-proofs
+## Proof
-Full suite green (`go build/vet/test ./...`, rc 0) before each build; controller gates green (go-parity after the three
-new keys were registered). Red-proofs, each seen FAILING on the mutant: RP-A1 (leftmost hop), RP-A2 (the tunnel hop as
-the key), RP-A3 (no reconcile of a running traefik), RP-D1 (no-container record healthy), RP-D1b (the 0.286.0 order),
-RP-D2 (no lock on a restore) — files under `audits/visitors-2026-10-01/{A,D}/RP-*`.
 
-## Live
+- Tests: `internal/family/family_test.go`, `internal/stacks/family_gate_test.go`, `internal/web/family_gate_test.go`.
-- **9202 (0.286.0, then 0.286.1, hand-set):** simulated tunnel — a stranger's 5 wrong dashboard logins with a rotating
+  **Red-proofs RP-F1..F7** (each mutant made its named test fail, then reverted): `A/RP-F-family-gate-mutants.txt`.
-  forged leftmost address locked only him; the household from another address in at once; LAN/impostor forgeries
+  Full suite rc 0; `controller_gates.py` OK.
-  counted as themselves. R-772: a stopped probe container read `healthy false, not_checked true` 14 s later (0.286.1).
+- **Live on 9202 through the product** (`A/items.txt`): a stranger 0 app answers of 36 (LAN + simulated tunnel); members
-  R-773: Karakeep removed + restored → `opened_by: restore`, stranger `/signup` 403 and `users.create` 403, data back.
+  in with their own logins, the websocket 101; reset/remove/logout end access at once; a stranger's 7 guesses locked
-- **Both demo boxes (floor 0.286.1, min_agent 0.131.0):** each made `felhom-tunnel`, wrote the clean-up file, recreated
+  only the stranger; each Grimmory exception kept Grimmory's own login and the look-alikes stayed gated; the controller
-  traefik and moved cloudflared to `.2` by itself (~5 s). demo-hp's REAL tunnel: an app sees
+  down → 500, never the app; the gate's own cost 0.49 ms median. Survived an Update and a remove + restore (`B/box/`).
-  `6.6.6.6,37.191.56.193, 172.16.253.2`; `X-Forwarded-Host` forged → gone; the dashboard counter keyed on
+- **Floor 0.287.0** (min_agent 0.131.0): both demo boxes on 0.287.0 in ~25 s (`E/floor.txt`). **Golden 0.287.0** baked,
-  `37.191.56.193`, locked after 5. Every demo-hp app answers through the tunnel. **ep0's one request was refused by
+  round-tripped, vouched (`felhom.eu/documentation/tests/golden-0.287.0-2026-10-02/`).
-  Cloudflare's edge (403) before the box** — the second outside address is unmeasured on the real tunnel (R-779).
-- **Golden 0.286.1** baked, round-tripped, vouched (golden 0.286.1 / agent 0.138.0 / min_agent 0.131.0); the hub then
-  refused golden 0.285.0 (R-120). `felhom.eu/documentation/tests/golden-0.286.1-2026-10-01/`.
-
-## NOT validated live
-- The app page's "not checked" line (render test only); R-773 on a block-only app (opengist/wishlist — same code path).
-- A box rolling back below 0.286 with the new traefik (R-778, reasoned).