4 Commits

Include renames

Author	SHA1	Message	Date
admin	2fe634141f	v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release ... R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx -> paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063: finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409 come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z. Each pinned by a red-proofed test. MinAgent 0.158.1.	2026-10-17 23:11:56 +02:00
admin	36c4aa4e69	v0.328.0 (unreleased): security review round 2 — nearest-ancestor symlink resolve (fail closed), any extends refused, the entry binds a literal image and its exact healthcheck, no variable in a bind's options ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:46:32 +02:00
admin	24d937d6e4	v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:42:18 +02:00
admin	6d90374f63	v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A) ... internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt, sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes, binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores (before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only event app_definition_refused once per definition and puts one line on the app page. The sync never copies a template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:34:12 +02:00