diff --git a/CONTEXT.md b/CONTEXT.md index 762c0d9..1d83dbe 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -7,7 +7,21 @@ > > Ask Claude Code: "Please update CONTEXT.md with what we did today" -Last updated: 2026-07-15 (v0.136.0 — .fab exclusion scoping, Task 4) +Last updated: 2026-07-15 (v0.137.0 — cleanup bundle: email-wipe guard + carried hygiene) + +> **2026-07-15 — v0.137.0: cleanup bundle (email-wipe guard + carried hygiene).** Closes the arc's +> carried micro-queue. **Part 1 (code):** `settingsNotificationsHandler` now REFUSES a save with a +> blank email box while events are enabled (it would push empty to the hub → wipe the customer's +> provisioning-seeded alert address — the 2026-07-15 demo incident). Returns before +> SetNotificationPrefs + sync, Hungarian error, repaints submitted checkboxes; empty+zero-events +> clear-all still allowed. No HTML `required` (it would block the legit clear-all). Tests + red-proof +> in `web/notifications_guard_test.go`. Deployed 0.137.0 to 9201 (healthy). **Part 2 (hygiene):** +> removed the confirmed-older `felhom-flash/backups/primary/immich` recovery unit (CreatedAt 06-23 < +> live usb 07-15, 44M); STOPPED audiobookshelf/komga/romm on flash (CreatedAt TIED with usb → +> tie-break is drive-order-dependent, not confirmable — manual disposition pending). **Part 3:** +> campaign6 is a bare empty leftover dir (not a live mount); safe `rmdir` refused (Permission +> denied — autofs-ghost/immutable); no mount disturbed → left for Viktor's reboot window. **Part 4:** +> tagged the campaign6 6D-audit finding track-only (felhom.eu `dee72cd`). > **2026-07-15 — v0.136.0: `.fab` exclusion scoping (Task 4).** Architecture §2 `.fab` row + SQ5 > verdict + R1-C. SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped diff --git a/REPORT.md b/REPORT.md index f513a2d..196ab8b 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,97 +1,69 @@ -# REPORT — `.fab` exclusion scoping (Task 4) — controller v0.136.0 +# REPORT — Cleanup bundle: email-wipe guard + carried hygiene — controller v0.137.0 ## Summary -Task 4: the `.fab` column of the matrix (SQ5 verdict + ruling #1 + Viktor's R1-C). **The SQ6 -over-capture is fixed for classified apps** — a manual export's userdata root tar is now -exclude-scoped (keeps only ancestors/descendants of a selected bind), so sibling apps' content no -longer rides along; an all-excluded app produces no userdata tar at all. Mechanics unchanged from -v0.130.0 (one root tar + per-mount skip), so the **manifest stays v1 and the import side is -untouched**; **legacy apps export byte-identically**. Mandatory is a server-side floor; optional is a -pre-selected checkbox; excluded is opt-in behind the two-number warning. +Four closing-the-loop items from the backup-redesign arc + 6D. One code fix (Part 1, shipped +v0.137.0), three operational/doc items executed inline. -## Baselines (live-verified at session start) +## Part 1 — empty-email notification save guard (CODE, v0.137.0) — SHIPPED -| Repo | `main` @ start | Version | → | -|---|---|---|---| -| felhom-controller | `5f21613` | v0.135.0 | **v0.136.0** | +**Problem:** `settingsNotificationsHandler` dropped a trimmed-empty `notification_email` into the +prefs and pushed it to the hub (`SyncPreferences`), overwriting the customer's provisioning-seeded +alert address — a customer saving any notification change with a blank email field silently wiped +their own hub-side alert delivery (the 2026-07-15 demo incident, restored by hand in 6D +P3-DELIVERY). -## Files +**Fix:** after computing the trimmed email + enabled events, refuse the save when +`email == "" && len(enabledEvents) > 0` — return **before** `SetNotificationPrefs` and any hub sync, +re-render with the Hungarian error `"Adj meg egy értesítési e-mail címet – bekapcsolt +értesítésekhez szükséges egy cím, ahova küldhetjük őket."`, and repaint the just-submitted +checkboxes (render-only overlay on `notificationsPageData`'s `NotificationPrefs`). The legitimate +empty-email + **zero** events clear-all still proceeds. `SyncPreferences` / the hub / the +seed-migration are untouched. Deliberately **no** HTML `required` attr (it is unconditional and +would block the legitimate clear-all — the server-side guard is the precisely-conditional floor). -- **mod** `internal/appbackup/captureset.go` — extracted `resolveGuardCollapse` (shared pipeline); new `ComputeFabBuckets` + `FabBuckets`. -- **new** `internal/appexport/fabplan.go` — `fabPlan`, `computeFabPlan`, `fabUserdataExcludes` + `classifyFabRel`, `tarDirectoryExcluding`, `fabEstimateSplit`. -- **mod** `internal/appexport/export.go` — `ExportRequest` += `DeselectOptional`/`OptInExcluded`; `dirLister` seam; `exportHDDData` consumes the plan; `tarDirectory` → thin wrapper. -- **mod** `internal/appexport/estimate.go` — `ExportEstimate` class-split fields (additive); `FabItem`. -- **mod** `internal/appexport/provider.go` + `cmd/controller/main.go` — `GetStackClassifiedBinds` on the export seam + adapter. -- **mod** `internal/web/handler_export.go` + `handler_export_download.go` — both start handlers carry the selections (two-call-site). -- **mod** `internal/web/templates/app_export.html` — the class-selection UI. -- **tests** new `fabbuckets_test.go`, `fabplan_test.go`, `fabexport_test.go`, `fab_export_test.go`; provider fakes updated. -- CHANGELOG / REPORT / CONTEXT / README. +**Tests + red-proof (`web/notifications_guard_test.go`, real temp-file Settings):** guard-fires +(stored email survives the refused save), legitimate clear-all proceeds, normal save persists. +Red-proof: neutering the guard → the stored email is wiped to `""` (the incident) → the test fails. +Full `go build/vet/test ./...` green. -Untouched (§5/§12): `manifest.go`, `validate.go`, `restore.go`, every import handler, `ExportDataMounts` — the verdict rests on the import side staying byte-identical. +**Deploy + live:** built + pushed `felhom-controller:0.137.0`, deployed to guest 9201 (Up, healthy; +`selfupdate: Current version 0.137.0 is up to date`). The protected asset is confirmed present — the +demo customer's notification email `nagyfenyvesi.viktor@gmail.com` is set. The authenticated UI +click-through needs the customer-owned claim password (CC does not hold it), so the server-side guard +is validated by the endpoint-equivalent unit test + red-proof (the CLAUDE.md live-validation proxy). -## Tests — results +## Part 2 — duplicate recovery-unit cleanup (HYGIENE) — 1 removed, 3 STOPPED -`go build ./... && go vet ./... && go test ./...` — **green.** New: bucket/guard/no-containment -(`ComputeFabBuckets`); plan scenarios A–F + §8 (unmatched-mount-kept, skip-when-none, mandatory floor, -nested excludes); `tarDirectoryExcluding` FS-level; export-level bundle tests (exclude-scoped tar, -legacy full-root, all-excluded no-tar); the two-call-site bundle test across BOTH start pipelines. +Recovery units are `/backups/primary//`; the controller's tie-break selects the newest by +manifest `CreatedAt`, else dir mtime (`backup/offbox.go:558-607`, first-in-order wins on a CreatedAt +tie). On `felhom-flash`: +- **Removed** `/mnt/felhom-drives/felhom-flash/backups/primary/immich` (44M) — CreatedAt + `2026-06-23T10:02:35Z` vs the live `felhom-usb` copy `2026-07-15T17:41:20Z` → **confirmed older**, + never selected. Prefix asserted (`*/felhom-flash/backups/primary/*`) before `rm -rf`. +- **STOPPED** (not deleted): `felhom-flash` **audiobookshelf, komga, romm** — their manifest CreatedAt + is **identical** to the `felhom-usb` copy (`2026-06-23T10:02:35Z`), so the controller's tie-break is + drive-order-dependent and I cannot confirm the flash copy is the non-selected/older one. Per the + STOP discipline, left for a manual byte-identity check / disposition (not this micro-task). -### §10 red-proofs (mutate → FAIL → revert), all verified +## Part 3 — campaign6 orphaned autofs (OPERATOR ACTION) — safe clear attempted, left for Viktor -| ID | Mutation | Test | -|---|---|---| -| A | legacy routed through the classified plan (drop short-circuit) | `FabExport_LegacyFullRoot` (userdata tar skipped) | -| B | always-tar the userdata root | `FabExport_AllExcludedNoUserdataTar` (tar present) | -| C | invert the keep-rule | `FabExport_ExcludeScopedUserdataTar` (mandatory excluded) | -| D3 | drop the server-side mandatory floor | `FabPlan_MandatoryFloor` (mandatory deselected) | -| E | skip guards for excluded buckets | `ComputeFabBuckets_GuardsAllClasses` (traversal enters a bucket) | -| F | drop selection fields from one start handler | `Fab_SelectionsRideBothStartPipelines/download` (opted-in content absent) | +`/mnt/felhom-drives/campaign6` is a bare empty leftover directory (`nobody:nogroup`) — **not** a live +mount (not a mountpoint, absent from the mount table, no autofs config / systemd unit / fstab entry). +A safe non-disruptive `rmdir` (refuses non-empty dirs + mountpoints) was **refused with Permission +denied** even as root (an autofs-ghost / immutable artifact). No live mount was disturbed (mount count +89→89; all 8 drive mounts intact). Not escalated to `chattr`/force (beyond a safe clear). **Left for +Viktor's demo-host reboot window** — CC did not reboot. -All reverted; post-revert full suite green; no residue. +## Part 4 — 6D audit doc tag (DOC) — committed -## Deploy / verify +Added the matching track-only disposition line to the campaign6 autofs LOW finding in +`felhom.eu/documentation/audits/CAMPAIGN-6D-2026-07-15.md` (consistency with the duplicate-recovery +LOW). Commit `dee72cd`. -Built + pushed `felhom-controller:0.136.0` on 180; deployed to guest 9201 → `Up (healthy)`. Commit -`cf9ce01`. - -## §13 live validation — the SQ6 before/after, on the real demo - -- **Leg 1 — before-picture (v0.135.0, the SQ6 protocol):** planted `SPIKE-marker-own.txt` under - calibre-web's `media/books/` and `SPIKE-marker-sibling.txt` under the sibling `media/movies/`; - exported calibre-web via the real UI (download pipeline, 356 MB). `tar tf` of the bundle's - `data/hdd/userdata.tar`: **BOTH markers present** (own=1, sibling=1, 15 `media/movies` entries) — - the whole userdata root rode along (the over-capture). -- **Leg 2 — after (v0.136.0):** re-exported calibre-web (default). `tar tf`: **own=1, sibling=0, - `media/movies` entries=0, `media/books` entries=39** — the sibling no longer rides along (Scenario C - live). radarr default export → the bundle has **no `hdd/` contents at all** (no userdata tar, - Scenario B live — radarr is classified all-excluded). -- **Leg 3 — opt-in + estimate split:** radarr's `download/estimate` returns - `has_classification:true` + `excluded_items:[{downloads, 308 MB}, {media/movies, 2.7 GB}]` (the - two-number-warning data, live, both pipelines). Re-exported radarr with - `opt_in_excluded:["userdata/downloads"]` → the userdata tar now carries `downloads` (2 entries) while - `media/movies` stays excluded (0) — the opt-in flips Scenario B, per-path, live. -- **Leg 4 — import compatibility (read-only):** the new exclude-scoped bundle's manifest is **v1** - (`version=1`, `hdd_subdirs=['userdata']`, `has_hdd_data=true`) — the untouched import maps the - `userdata` basename → `/userdata` via the existing fallback, so the smaller tar restores - exactly as before. A destructive live import over calibre-web (`compose down --volumes`) was NOT run - — compatibility is structurally guaranteed (v1 manifest + untouched import) and unit-proven - (`roundtrip_test.go`). -- **Leg 5 — hygiene:** removed the two SPIKE markers from live userdata and the test `.fab` bundles; - cleaned the 180 session temp. Listed removals above. - -## 6D-pending - -- **CAMPAIGN-6D Accept #1** (the ≥1 GiB `.fab` full circle) now runs against this final capture shape — - a real export→transport→import round-trip of a large classified app, exercising the exclude-scoped - userdata tar end-to-end (the live leg-4 import was deliberately read-only here). -- Carried from earlier tasks: `PlaceOffsiteRestore` against live data; the SQ3 immich offsite-only - full circle; organic enlarge-block firing. - -## Observations - -- `ComputeCaptureSet` was refactored to share `resolveGuardCollapse` with `ComputeFabBuckets` (no - duplicate pipeline); its existing tests stayed green through the refactor. -- The estimate split is in the shared `EstimateExport`, so both estimate pipelines surface it by - construction; the genuine two-call-site risk (and the F red-proof) is on the START selections, which - the bundle test exercises per-handler. +## Queue after this bundle +- **Pending operator (Viktor):** campaign6 autofs clears on the next demo-host reboot; the tied-CreatedAt + `felhom-flash` audiobookshelf/komga/romm duplicates await a manual disposition. +- **Deliberately not here** (correctly deferred): Peti-return runbook (hardware-gated); P4-DEEP timing + + P-TIER2 deep-4 (pre-broad-launch resilience); agent 0.88 publish (6D P-DAY0 shows the manifest already + vouches 0.88/golden-0.136 — likely closeable, verify separately).