REPORT/CONTEXT: agent 0.159.1, the catalog allow-list (controller v0.328.0), its catalog gate (2026-10-17)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -1,5 +1,10 @@
 # CONTEXT.md — Project Memory
 
+
+> **2026-10-17 (late) — v0.328.0 is the floor (MinAgent 0.158.1): the catalog allow-list (R-971, operator decision D2 = A).**
+> `internal/privpolicy` refuses container rights not on the compiled list before ANY compose write; refusal = nothing
+> written + `app_definition_refused` (hub ≥ 0.157.0) + an app-page line. Three security-review rounds fixed before the
+> release; a live finding on 9201 (rc.4) fixed in rc.5. Follow-ups R-1142 (cross-app appdata), R-1143 (`:latest`).
 > This file serves as persistent project memory across Claude Code sessions.
 > It replaces the auto-generated "Memory" from the claude.ai Project.
 > **Update this file at the end of each working session** with current state,

REPORT.md

@@ -1,29 +1,26 @@
-# REPORT — v0.327.0: FileBrowser published only after its default login is checked; real memory amounts in the install check (2026-10-17)
+# REPORT — v0.328.0: the catalog allow-list (R-971, operator decision D2 = A) (2026-10-17)
 
-Brief „FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail, STATUS".
-Full report: felhom.eu `REPORT-filebrowser-memory-ci-2026-10-17.md`. Evidence: felhom.eu
-`documentation/audits/filebrowser-memory-ci-2026-10-17/`.
+Written in ASD-STE100 Simplified Technical English. Session report: felhom.eu `REPORT-agent-allowlist-rotation-2026-10-17.md`.
+Evidence: felhom.eu `documentation/audits/agent-allowlist-rotation-2026-10-17/P2/`, `P5/`.
 
-## 1. What changed
+- **What:** `internal/privpolicy` checks the RENDERED compose before every compose write and env decision (sync,
+  update/ladder step, install, two settings changes, two restores — before the stop) against `allowlist.json`
+  (go:embed; one entry: homepage's read-only socket, bound to its image, start and healthcheck). Refusal: nothing
+  written, operator event `app_definition_refused` (hub ≥ v0.157.0), app-page line, plain message. Sync never copies a
+  template named like an infra stack.
+- **Tests:** `privpolicy_test.go` (every class, positive controls, the three review rounds, the live root finding),
+  `TestAllowList_IsWiredIntoEveryComposeWriter` (AST), `sync.TestR971_*`, `stacks.TestAllowList_*`,
+  `TestR971_AppPage_*`; full suite green on `99f9117`. Red-proofs in P2.
+- **i18n:** new fixture `app_settings_definition_refused`; every other fixture byte-identical. Keys
+  `err.stacks.definition_refused`, `app_info.definition_refused` in both bundles.
+- **Release:** rc.1–rc.5 on demo-hp 9201; 0.328.0 to Tester 1, demo-hp, demo-felhom by per-box floors (all three in
+  < 1 min), box walk green (0 refusals, all containers healthy, login and files 200), https-only green; global floor
+  0.328.0, MinAgent 0.158.1; per-box floors cleared; read back from the hub DB with its WAL.
+- **9201 proof:** drill catalog with `privileged: true` on privatebin → refused; compose sha and container unchanged;
+  event at the hub + operator mail; page line on privatebin only; live catalog restored byte-identical.
 
-- **R-1126:** `internal/infra/infra.go` (FileBrowser on `felhom-filebrowser`, not `traefik-public`), `internal/stacks/filebrowser_gate.go`
-  (join, check, publish by container ID), `internal/stacks/infra.go` and `internal/web/handlers.go` (call sites).
-- **R-1125:** `err.stacks.not_enough_memory` and `deploy.nincs_eleg_memoria_foglalas_telepites` reworded (HU/EN);
-  `stacks.InstallMemory` shared by the check and the install page.
+## Observations
 
-## 2. Tests (each red-proved)
-
-`TestFileBrowserRender_R1126_NotPublicAtStart`, `TestFileBrowserGate_PublishedOnlyAfterTheCheck`,
-`TestFileBrowserGate_ConnectsTheCheckedContainerById`, `TestR1125_NotEnoughMemorySaysWhatToDo`,
-`TestR1125_InstallMemoryIsTheChecksReading`. Fixtures: two re-captured as `*_r1125`; every other byte-identical.
-
-## 3. Live (scratch 9202)
-
-FileBrowser + its data removed: 143 probes through Traefik, the default login never 200. Install of a 150 MB app with
-50 MB free: refused (400) in HU and EN, nothing installed; the page showed the same numbers as the check (2,798 vs 2,698).
-
-## 4. Observations
-
-1. FileBrowser's own admin-password setting re-applies at every start (measured). NOT-A-FINDING: why Path 2 was built.
-2. The install page used `/proc`'s host-wide memory, not the check's reading. NOT-A-FINDING: fixed in this release.
-3. A TOCTOU in the first gate (connect by name). NOT-A-FINDING: found by the commit security review, fixed before release.
+1. rc.4 refused every not-installed app on the box (placeholder roots do not exist there). NOT-A-FINDING: found by this session's own live proof and fixed in rc.5 before the release, red-proved.
+2. One app can still bind another app's `appdata/<name>`. FILED: R-1142.
+3. `build.sh` pushes `:latest` with every build, rc included. FILED: R-1143.