# REPORT — v0.287.0: the family gate (decisions 63/64, R-780) — 2026-10-02

Full session report: `felhom.eu/REPORT-family-gate-2026-10-02.md`. Evidence: `felhom.eu/documentation/audits/family-gate-2026-10-02/`
(A = the controller live on 9202, B = the catalog apps on 9202, B4 = a demo box, E = the floor). Architecture read:
`01-topology-and-trust.md` §5 (now with the family gate paragraph), `09` §3 decisions 46, 47, 63, 64.

## What shipped (v0.287.0, commits 977665d + c8d5ee2)

- **`internal/family`** — the household's family members: own name + password each (4×4 letters, shown once, bcrypt in
  `family.json` 0600), sessions of 30 days, asked on EVERY request (`Valid`), so reset / remove / logout end access at
  the next request. A wrong name costs the same bcrypt time as a right one.
- **`internal/stacks/family_gate.go`** — a template's `family_gate: true` gets a traefik forwardAuth door per router,
  written BEFORE the first start (an app is never published open); `family_gate_except:` literal prefixes become
  routers without the door, anchored `^/prefix(/|$)` (finding F1); the record is written at install and at a removed
  app's restore; the tick rewrites/removes the files. `min_controller:` refuses a template that needs a newer box.
- **`internal/web/family_gate.go`** — `/__felhom_gate/family` (forwardAuth), `/__family/start|login|logout` on the
  dashboard host; the family cookie (`Path=/__family`) is NEVER accepted by RequireAuth; the sign-in locks per visitor
  (5/min, via `rateKey`, R-753) and per name (10/10 min). The Család card (Settings → Security): add / new password /
  remove, password once, `no-store`. hu + en, informal „te", no „kérjük"; parity green.

## Proof

- Tests: `internal/family/family_test.go`, `internal/stacks/family_gate_test.go`, `internal/web/family_gate_test.go`.
  **Red-proofs RP-F1..F7** (each mutant made its named test fail, then reverted): `A/RP-F-family-gate-mutants.txt`.
  Full suite rc 0; `controller_gates.py` OK.
- **Live on 9202 through the product** (`A/items.txt`): a stranger 0 app answers of 36 (LAN + simulated tunnel); members
  in with their own logins, the websocket 101; reset/remove/logout end access at once; a stranger's 7 guesses locked
  only the stranger; each Grimmory exception kept Grimmory's own login and the look-alikes stayed gated; the controller
  down → 500, never the app; the gate's own cost 0.49 ms median. Survived an Update and a remove + restore (`B/box/`).
- **Floor 0.287.0** (min_agent 0.131.0): both demo boxes on 0.287.0 in ~25 s (`E/floor.txt`). **Golden 0.287.0** baked,
  round-tripped, vouched (`felhom.eu/documentation/tests/golden-0.287.0-2026-10-02/`).