v0.287.0: CHANGELOG, README, REUSE (the family gate)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,32 @@
+## v0.287.0 — the family gate: family members with their own logins in front of chosen apps (decisions 63/64, R-780) (2026-10-02)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `family_gate.*`, `err.stacks.family_gate_failed`,
+`err.stacks.needs_newer_controller` (both languages). **Catalog companion:** `family_gate:`, `family_gate_except:` and
+`min_controller:` in `.felhom.yml` (a template with `family_gate` must say `min_controller: "0.287.0"`).
+
+- **The family list** (`internal/family`): the household's dashboard admin adds, resets and removes family members on the
+  security page („Család" card). Each has their OWN name and a generated password (4×4 letters/digits, shown once, in the
+  answer to the press — never in a page, never logged). Sessions last 30 days and survive a restart (`family.json`,
+  0600, atomic). A reset (the member's generation moves on), a removal or a logout ends access at the next request.
+- **The door** (`internal/stacks/family_gate.go`): an app whose template says `family_gate: true` gets a traefik
+  forwardAuth file BEFORE its first start (also when a removed app is restored); a life record (`family_gate:` in
+  app.yaml) keeps it while the app is installed — a catalog change never gates or un-gates an installed app. Priority
+  below the install hold, the setup gate and the sign-up block. `family_gate_except:` lists literal path prefixes
+  (e-reader and phone apps) routed WITHOUT the door — **anchored** `^/prefix(/|$)` (the spike's finding F1: an unanchored
+  `PathPrefix(/api/v1/opds)` let `/api/v1/opdsx` through); a matcher or regex in the template refuses the install.
+- **The answerer** (`internal/web/family_gate.go`): `/__felhom_gate/family` (forwardAuth; the app cookie
+  `felhom_famgate` is host-only and names a store session); `/__family/start|login|logout` on the dashboard host,
+  outside the dashboard's auth (the family session cookie `felhom_family` is scoped to `Path=/__family`). The sign-in is
+  counted per VISITOR (`clientIP`, R-753: 5 per minute) and per NAME (10 per 10 minutes) — a stranger locks only himself;
+  a name under a spread attack waits minutes. The household's dashboard session vouches (decision 46's rule) as a
+  household session in the family store. **`RequireAuth` never reads a family cookie; no family page ever sets the
+  dashboard cookie.** While the controller is down a gated app answers an error (traefik's forwardAuth), never the app.
+- **`min_controller:`** — a template that needs a newer box is refused before anything is written.
+- Tests: `TestFamily_*` (store), `TestFamilyGate_*` (web: stranger, member-not-dashboard, reset/remove/logout, locks,
+  household, token, setup gate untouched, messages, card), `TestFamilyExceptRegexp_Anchored`, `TestFamilyGate_*`
+  (stacks: before the first start, bad exception refuses, restore + loop), `TestMinController`. Red-proofs RP-F1..RP-F7,
+  each seen failing (`felhom.eu/documentation/audits/family-gate-2026-10-02/A/`).
+
 ## v0.286.1 — R-772 found live: a stopped probe container is seen on the next tick (2026-10-01)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. **v0.286.0 was never floored**