100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	dfd0f8ec53	fix(R-1187 a,b,d,f,g): .fab — links carried and restored safely, FIFOs refused, owners kept, busy and bad-path refusals, postgis + ON_ERROR_STOP ... Red-proved (6 tests). Commit only.	2026-10-26 20:26:02 +01:00
admin	1170b48e59	fix(R-1218, R-1219): stage the off-site password when its file exists; no recovery ceremony during a recovery offer ... R-1218: escrowStart stages when OffboxRepoPasswordOnBox() (not OffboxConfigured()). R-1219: the top bar hides during an offer; the start handler answers 409 (api.escrow.recovery_offer_open, hu+en) before staging. Red-proved. Commit only.	2026-10-26 20:20:59 +01:00
admin	7e15a374b2	fix(R-1220): an unreadable app.yaml counts as installed — its folders are never kept data ... liveDriveBinds(drives): an app whose app.yaml exists but does not parse binds every folder its compose names on every drive (fail closed); WARN per app. Red-proved (the live folder was listed). Commit only.	2026-10-26 20:13:44 +01:00
admin	e333477b11	docs: REPORT — D53 (committed, not released; live-proven on 9202 against a test hub)	2026-10-26 19:16:59 +01:00
admin	5bd03ad152	feat(D53): the hub learns which apps are held — app_held / app_hold_cleared, daily repeat ... internal/holdreport: one observer of the hold store, ticked every minute; app_held for a new or changed hold (stack_name, reason, since, why), app_hold_cleared when gone (also while the controller was down: settings.reported_holds), every hold again daily and at start. Severity info. RestoreHold.Why/WireReason (holdWhy calls it). 8 tests, red-proved (inert Tick; unwired scheduler line). Commit only (felhom.eu 08 §10).	2026-10-26 18:23:54 +01:00
admin	20cf4bccfd	docs: CONTEXT — D53 ruled, the held-app report is next (felhom.eu 08 §10)	2026-10-26 18:07:22 +01:00
admin	5ce54a5076	REPORT: the 2026-10-26 afternoon run. Docs only.	2026-10-26 14:37:53 +01:00
admin	6bfb784c4d	v0.345.0: release header (R-1292, live on Tester 1); README	2026-10-26 14:12:37 +01:00
admin	26191911c4	R-1292: qBittorrent's 50 % rule owns the NORMAL limit only (up_limit through app/preferences), never the current speed mode's slot. Test with the alternative mode on, red-proved. Commit only.	2026-10-26 13:01:31 +01:00
admin	3d711ee611	REPORT: the 2026-10-26 attended release run; CHANGELOG: v0.344.0 RELEASED (floor 09:07:47 UTC). Docs only.	2026-10-26 10:37:41 +01:00
admin	0a59044105	v0.344.0: release header (upgrade note: the file manager restarts once); README — R-1261, R-1281, R-1288, R-1278, R-1286, R-1282	2026-10-26 09:04:30 +01:00
admin	9c1dfdd71f	REPORT: the 2026-10-25 night — committed fixes, CI by hash, teardown. Docs only.	2026-10-25 23:53:46 +01:00
admin	fbec5cb499	R-1278: the install page says when a backup of an earlier install is kept and links the restore page (HU and EN). Red-proved. Commit only.	2026-10-25 23:32:01 +01:00
admin	7ea942a118	R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.	2026-10-25 22:26:45 +01:00
admin	838c834169	R-1286: a held app says why it is held — each hold reason gets its own sentence in the start gate, the boot sweep and --restore-holds (an unhealthy stop read as a failed restore). Red-proved. Commit only.	2026-10-25 22:05:23 +01:00
admin	b5863a96eb	R-1288: a restore of a set-aside unit sets the replaced install's unit aside at once, with no alarm. R-1282: the later media restart time is stored and resumed at start, once. Red-proved. Commit only.	2026-10-25 21:37:55 +01:00
admin	a79a292d72	R-1261: the line hold holds every running seeder, drops the record of an app removed while held, and puts back the qBittorrent slot it held (alternative speed). Red-proved. Commit only.	2026-10-25 20:38:28 +01:00
admin	fe9837708a	v0.343.0 released (global floor 17:53:42 UTC on the operator's yes): CHANGELOG header, REPORT	2026-10-25 19:02:08 +01:00
admin	e2a976198d	v0.343.0: release header; README — fix A (stable start), fix B (.fab downloads first), D47 set-aside line	2026-10-25 18:02:52 +01:00
admin	935e624f10	D47 follow-up: a set-aside tells the operator once (backup_run_failures, leg unit-set-aside, both identities, own run id). Red-proved. Commit only.	2026-10-25 17:19:08 +01:00
admin	3a1f09d29f	Fix A (found live on 9202): the container sampler reads docker inspect JSON — a -f template stopped at 'no entry for key Health' for every app without a healthcheck, so a healthy restore read 'not started'. Commit only.	2026-10-25 17:02:32 +01:00
admin	1ee0353dbd	Fix A: the container sampler keeps Docker's stderr in its error (a live run on 9202 logged only 'exit status 1'). Commit only.	2026-10-25 16:56:04 +01:00
admin	35232de80d	Fix A: the stable-start sampler says at DEBUG why a sample is not ok (a live run on 9202 judged a healthy app unstable; the reason was not logged). Commit only.	2026-10-25 16:43:57 +01:00
admin	2149a13378	Fix A, the page too: the restore's first verdict needs a stable 45 s after the 90 s health wait on every path, so an app that runs, crashes and restarts reads „not started yet”; the copy still waits the full 3 minutes. Red-proved. Commit only.	2026-10-25 13:06:06 +01:00
admin	7720439440	D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.	2026-10-25 12:45:33 +01:00
admin	e8d2151a77	Restore-truth run close-out: REPORT (D47, D48, R-1270, R-1271; CI by hash; live proofs on 9202). Commit only.	2026-10-25 11:00:09 +01:00
admin	1f8295918e	R-1270 follow-up (found live on 9202): remove with „delete its backups too” deletes the app's restore-undo folder too — a not-started restore's kept copy outlived the remove; the wiring test also pins the D47 set-aside removal. Red-proved. Commit only.	2026-10-25 10:36:20 +01:00
admin	1f9c863f79	D47 follow-up (found live on 9202): the kept-copies list („Megőrzött másolatok”) shows on a box without off-site too — it sat only inside the off-site card, so 9202 never listed a set-aside unit or a D25 copy; one named template, two call sites, parity fixtures unchanged. Red-proved. Commit only.	2026-10-25 10:01:56 +01:00
admin	bd9f4f7b74	R-1271 (P2): „use my kept data” never takes a copy dated in the future — a copy more than 10 minutes past the box's clock never counts as the newest (the newest true date wins, tie local); alone it is still offered, said and not recommended. Red-proved. Commit only.	2026-10-25 09:44:56 +01:00
admin	2d71270858	D48: a restore downloads first — every restore path resolves and pulls every image of the definition that will run before the stop, under the image-work lock held until the restore returns; a failed pull refuses with the app untouched (a deleted version and a busy registry read differently), one operator line. Red-proved. Commit only.	2026-10-25 09:38:28 +01:00
admin	b680db85cb	R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.	2026-10-25 09:33:26 +01:00
admin	02daebe9c5	D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.	2026-10-25 09:27:48 +01:00
admin	e1613aea8d	Restore-holes run close-out: README, CONTEXT, REPORT; the interrupted-restore log line names a waiting put-back. Commit only.	2026-10-24 21:03:34 +02:00
admin	c9b4b82dc7	R-1253 (P2): an export that stops its app refuses while another operation (a restore) holds the app-stop marker — its Undo is never replaced. Commit only.	2026-10-24 20:29:59 +02:00
admin	518a13592d	R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.	2026-10-24 20:07:16 +02:00
admin	062f9b41d9	R-1251: sync the restore copy's folders before the marker names it (a cut left undo.json as .tmp on Tester 1); the interrupted-restore record says the put-back waits, not 'run it again'. Commit only.	2026-10-24 19:36:32 +02:00
admin	bb2809dc68	R-1251 (P1): a pending put-back blocks every start — a cut restore's copy on an unbound drive waits (a restore hold), is poured back when the drive binds before any start; a failed put-back holds the app (H2); Stop during a restore still puts back (H7). Commit only, unreleased.	2026-10-24 19:07:02 +02:00
admin	2449223f10	Review round 2 docs: REUSE.md — D22 released (v0.338.0), recordInstalledImages callers, a row for the stray-copy seams; no code change	2026-10-24 16:00:25 +02:00
admin	b01bb4b88d	Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased	2026-10-24 15:26:56 +02:00
admin	321df1f87a	README §8e + REPORT: R-1250 hold, live proof on demo-hp	2026-10-24 13:48:15 +02:00
admin	046b808792	upwatch: hold a seeding torrent app for one line test, then put its limit back exactly (R-1250) ... When the agent waits for quiet and qBittorrent or Transmission runs: record the limit first, hold at 1 KiB/s, ask the agent for a test on request, put the old limit back (deferred; a household change during the test stays). Start-up puts back a limit a killed controller left; the 50 % rule skips while a hold record exists. Commit only.	2026-10-24 13:19:07 +02:00
admin	bddc477e22	CHANGELOG: v0.342.0 released (the upload and CPU watch, the tested line, qBittorrent's limit); REPORT	2026-10-24 10:28:53 +02:00
admin	42cda07b42	v0.342.0 (unreleased): the watch's start line no longer says the line is learnt only from the off-site push	2026-10-24 09:58:13 +02:00
admin	ed1011b088	v0.342.0 (unreleased): the upload watch reads the host's weekly line test (GET /host/line-test, agent >= 0.164.0); qBittorrent's limit = 50 % of the TESTED line only (D41), the watch uses the higher of test and push floor, the system page names the source; red-proved	2026-10-24 08:59:57 +02:00
admin	60e487db51	docs: v0.342.0 (unreleased) — CONTEXT note and REPORT for the upload watch; live proofs on scratch 9202	2026-10-23 22:56:39 +02:00
admin	a9c1997fbc	v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's) ... internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s, 25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex, app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs. Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.	2026-10-23 21:26:09 +02:00
adminandClaude Opus 5.5	277e99839d	docs: v0.341.0 released — global floor 11:24 UTC on the operator's yes, MinAgent 0.158.1; the live proofs in REPORT (no code change) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:30:54 +02:00
adminandClaude Opus 5.5	63dcccfeec	v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:09:52 +02:00
admin	32e61d5d1d	REPORT: day 2026-10-23 — controller 0.340.0 released (floor 06:41 UTC, MinAgent 0.158.1)	2026-10-23 11:07:44 +02:00
admin	caaa86eb3c	v0.340.0: release — the capped night copy that never outlives the controller (R-1214 + stray-copy fix), Immich's model cache out of backups (R-49), no import over a stopped app (R-1187 c), the catch-up checks (R-1189 d, C5); MinAgent 0.158.1	2026-10-23 08:19:45 +02:00
admin	23f77f93ba	night 2026-10-23 docs: CONTEXT (0.340.0 candidate), REPORT (both review rounds, rc.8 re-proof), the OffsiteStateAwaitingRecoveryKey comment corrected (its hub claim was measured false: felhom.eu R-1230); no behaviour change	2026-10-23 00:05:34 +02:00
admin	1babfe94f6	Second-drive copy: two races closed — the start-up/retry removal holds the destination's lock (a copy this process starts is never removed), and a run records itself in one step with the restore check, every leg asking again; red-proved, race-clean; unreleased	2026-10-22 22:58:33 +02:00
admin	9d9e4041c9	Second review of the night's own code: a stray clears when a later removal works (N2), the start-up check never removes this process's own copy (N3), one copy per destination at a time (N4), RunTier2 refuses during a restore for every caller (N5), the import refusal no longer advises removal (N9); red-proved, race-clean; README; REPORT; unreleased	2026-10-22 22:45:42 +02:00
admin	943c517550	Review fixes for 0.340.0: C5 a catch-up releases the whole-guest backup when its backup legs end (red-proved); C3 the R-1187 c refusal text fits an unhealthy app; C6 two comments; C8 README backup.volumes wording; unreleased	2026-10-22 21:25:48 +02:00
admin	912e59210d	Stray-copy fix: the copy container runs with --no-healthcheck (the image's controller health check showed it as starting on the 9202 proof); unreleased	2026-10-22 20:39:05 +02:00
admin	66a69d4954	Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased	2026-10-22 20:20:35 +02:00
adminandClaude Opus 5.5	df78b6caae	night 2026-10-22: README (backup.volumes excluded, the capped second-drive copy), CONTEXT, REPORT — four fixes on main, not released (0.340.0 next) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-22 18:11:45 +02:00
admin	ae394670c1	R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased	2026-10-22 17:51:14 +02:00
admin	03c0a693b8	R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased	2026-10-22 17:47:19 +02:00
admin	d5f88a2182	R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased	2026-10-22 17:27:56 +02:00
admin	6a17c95815	R-49 (D21 = B): a template may exclude a named volume from every backup (backup.volumes, class excluded) — Immich's model cache; guarded, red-proved; unreleased	2026-10-22 16:21:38 +02:00
admin	cbc944c3c0	REPORT: v0.339.0 released (R-1199 reopened, R-1216)	2026-10-22 13:15:42 +02:00
admin	fc5a20f40a	v0.339.0: release — the household's mail list never overwritten (R-1199 reopened), the swap sentence only when swap is really short (R-1216); MinAgent 0.158.1	2026-10-22 12:57:24 +02:00
admin	add310c80a	R-1199 reopened: a box with no list of its own reads the household's from the hub and adopts it, pushes its default once only when no household saved one; every push names its source; an empty saved list stays empty; R-1216 (D28 = A): the install page's swap sentence only when host swap is really short (shared case table); unreleased	2026-10-22 12:13:26 +02:00
admin	08fa440d04	REPORT: v0.338.0 released (operator yes 2026-10-22): 3 test boxes through the floor, checks green, global floor set	2026-10-22 10:39:43 +02:00
admin	7900a32695	v0.338.0: release (operator yes 2026-10-22) — D22 restore put-back, first-hour words, swap sentence, R-1199; MinAgent 0.158.1	2026-10-22 09:51:27 +02:00
admin	1de8a559ed	REPORT: the night of 2026-10-21 (D22, words, R-1199; rc.2), unreleased	2026-10-22 00:06:36 +02:00
admin	f0abdd0eda	CHANGELOG: blank line before v0.337.0	2026-10-21 23:41:10 +02:00
admin	ba22f9b2d9	R-1199: a box whose household never saved its notification choice pushes the default list its page shows at start, so the hub mails by it; unreleased	2026-10-21 23:40:21 +02:00
admin	5776d54901	W21 sharing switched on without a password asks for it and says why it waits; W25 failed off-site run shows the household a sentence built from the classifier, raw text only to log and operator; W28 share restore skips the controller's drop-zone share; unreleased	2026-10-21 23:19:07 +02:00
admin	28b05d6d68	W13 new-drive pages pre-fill the next free hdd_N and answer a bad name visibly; W14 drive operator detail behind Részletek; W29 plain decommission names no move; unreleased	2026-10-21 22:51:08 +02:00
admin	8c1e290f63	W12 family names keep their accents, login made without them; W9 banner link colour; W10 recovery-code page one plain line; W11/W24 remote page hides provider login and key fields behind Haladó; unreleased	2026-10-21 22:35:24 +02:00
admin	37b79caad9	install page: say when the host has too little swap behind the guest (R-1192 follow-up); restore record log says when a cut restore was put back; unreleased	2026-10-21 22:11:16 +02:00
admin	d582feb245	D22: every restore puts the data back exactly on failure and after a power cut (R-1177, R-1195); whole restore asks the unit first (R-1178); no mirror during a restore (R-1180); W22 restore refusals in Hungarian; unreleased	2026-10-21 21:19:46 +02:00
admin	7848d4aaac	CHANGELOG: v0.337.0 (MinAgent 0.158.1)	2026-10-21 15:58:43 +02:00
admin	5929b8e345	kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased	2026-10-21 15:46:10 +02:00
admin	8f5bea0148	R-1182: a finished off-site abandonment closes on the hub's abandon_purge_done (hub v0.163.0 keeps other copies' packages); unreleased	2026-10-21 13:36:12 +02:00
admin	01c967e49e	monitoring page: storage labels follow the reader's language (W26, rehearsal 2026-10-20); unreleased	2026-10-20 22:36:19 +02:00
admin	7ca59e2de3	CHANGELOG + CONTEXT: v0.336.0 release line (the previous commit carried only REPORT)	2026-10-20 10:58:00 +02:00
admin	aa9e09e817	CHANGELOG + CONTEXT + REPORT: v0.336.0 released (floor 08:54 UTC, MinAgent 0.158.1) after the 9202 proof and the three test boxes	2026-10-20 10:56:59 +02:00
admin	93fb251ea9	R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)	2026-10-20 09:17:00 +02:00
admin	ae2bfb2f7a	REPORT: the security-scan gate (R-986)	2026-10-19 21:48:13 +02:00
admin	a03c25aa1f	security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)	2026-10-19 21:11:31 +02:00
admin	c4b3b0a039	REPORT: v0.335.0 is the floor (R-921)	2026-10-19 20:40:07 +02:00
admin	15ea002458	v0.335.0: no app stop for a tier the agent will refuse because its host is busy (host_busy pre-check, R-921)	2026-10-19 20:05:52 +02:00
admin	db980ff2cc	REPORT: v0.334.0 is the floor (R-1159)	2026-10-19 16:33:58 +02:00
admin	546eef37bd	v0.334.0: a live box refreshes its config with its own hub key (GET /box-config; R-1159, operator D19)	2026-10-19 15:55:10 +02:00
admin	e1a2abf1e3	REPORT: v0.333.0 is the floor (R-1155, R-1161)	2026-10-19 12:16:57 +02:00
admin	a6fa3c01d2	v0.333.0 (unreleased): the R-1155 check reads every token source FileBrowser reads, Basic auth included (security review)	2026-10-19 11:43:52 +02:00
admin	c809dd3bc6	v0.333.0: the file manager's own token ends with the dashboard sign-out (R-1155); the recovery-code page says the code becomes live after the check (R-1161)	2026-10-19 11:30:59 +02:00
admin	a741bc1d0f	CONTEXT + REPORT: v0.332.0 is the floor (R-1100 one sign-in, R-1151 escrow confirm)	2026-10-19 05:41:25 +02:00
admin	601bdba253	v0.332.0 (live rc.2 + security review): the pass redirect is absolute; no pass for a cross-site request; no dot-segments in to (R-1100)	2026-10-19 05:03:57 +02:00
admin	9bdd8f8fe8	v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)	2026-10-19 04:56:56 +02:00
admin	ba4a6f060b	The escrow wizard sends the typed-back words to the box; the new package reaches the hub only when they match (R-1151 controller half, unreleased; works with every agent)	2026-10-19 03:19:02 +02:00
admin	8ae9178138	v0.331.0: a removal deletes the volumes still labelled with the app's project that its definition no longer declares (R-1117) ... compose down --volumes removes only the current definition's volumes; a volume a template dropped (or an older restore re-created) survived 'remove with data' on 9202 (nextcloud_nextcloud_redis_data). Red-proofed.	2026-10-18 22:42:52 +02:00
admin	772ef36f5f	v0.331.0: OnlyOffice opens and saves from FileBrowser and Nextcloud; FileBrowser back at once after a restart (R-1018) ... FileBrowser config carries server.internalUrl http://filebrowser:80 (OnlyOffice fetched the public files address and got 403); Nextcloud's DocumentServerInternalUrl gets its trailing slash (every save was lost: http://onlyoffice:80cache/...); RestartStack("filebrowser") runs the R-1126 gate at once (files.<domain> was 502 for up to 5 min after the link switched). Each red-proofed. MinAgent 0.158.1.	2026-10-18 21:05:04 +02:00
admin	615940de35	CI workflow: the failure mail links the public run page, by run id (R-1135) ... The alarm step built its link from GITHUB_SERVER_URL, which on this runner is the in-cluster Gitea address, and from the run NUMBER, which Gitea 1.26 reads as a run id first (felhom.eu /actions/runs/1116 opened run id 1116 = run number 613). Now https://gitea.dooplex.hu + GITHUB_RUN_ID, and the link is printed into the job log as ALARM-LINK. Same change in all four repos.	2026-10-18 20:34:59 +02:00
admin	6c6bd87664	v0.330.0: „Végleges leszerelés — mégis" asks the agent's disk list first and starts again the apps it stopped when the agent refuses (R-1144) ... Red-proofed twice. MinAgent 0.158.1.	2026-10-18 13:06:09 +02:00
admin	03ab121b25	v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env ... Security review of 2fe6341 (same night, before any release). Both red-proofed.	2026-10-17 23:22:54 +02:00
admin	2fe634141f	v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release ... R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx -> paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063: finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409 come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z. Each pinned by a red-proofed test. MinAgent 0.158.1.	2026-10-17 23:11:56 +02:00