admin 09ac87a843 v0.328.0 (unreleased): security review round 3 — under HDD_PATH only appdata/ is a data root (not backups/) ...

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-17 16:49:17 +02:00

..

aftercrash

v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

2026-10-14 16:47:13 +02:00

agentapi

v0.318.0: a part is offered for formatting only while nothing on its disk is mounted (agent 0.158.1 formattable)

2026-10-16 04:05:09 +02:00

api

R-970: the box's hub key opens no route; Data tab leftovers; R-1103: the install form's dead branches

2026-10-16 18:24:00 +02:00

appbackup

R-1110: the guard's census is 42 calls, not 41 (measured; comment and CHANGELOG)

2026-10-17 10:24:48 +02:00

appexport

…

assets

…

backup

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

backupwindow

…

bootrecon

…

bootstrap

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

channelhealth

R-271: the channel recovery after a controller restart is reported

2026-10-05 21:55:37 +02:00

cloudflare

…

config

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

crashboot

v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

2026-10-14 16:47:13 +02:00

crypto

…

dockerexec

R-35 (D4): dashboard sign-ins survive the controller's own restart; disk holds only a fingerprint

2026-10-08 14:49:27 +02:00

family

R-1112: open the family store when the controller starts

2026-10-17 09:56:12 +02:00

fillwatch

v0.309.0: the fill warning reaches the household in its own language; the root-filesystem disk event pinned end to end (R-521 F7)

2026-10-12 17:11:53 +02:00

i18n

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

infra

v0.327.1: files.<domain> reaches FileBrowser again — a file route by name, not Docker labels

2026-10-17 13:56:45 +02:00

integrations

…

logx

…

mailrelay

…

mediawire

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

metrics

v0.295.0: a box that was off at its backup time catches up once (R-871, decision 109); the missed-backup banner (decision 110); a late daily timer after a host suspend is skipped

2026-10-05 09:27:16 +02:00

monitor

health check: the last six producers carry their dashboard sentence (R-79 option A, D3)

2026-10-08 14:49:27 +02:00

nightchain

v0.295.0: a box that was off at its backup time catches up once (R-871, decision 109); the missed-backup banner (decision 110); a late daily timer after a host suspend is skipped

2026-10-05 09:27:16 +02:00

notify

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

offsiteapply

…

privpolicy

v0.328.0 (unreleased): security review round 3 — under HDD_PATH only appdata/ is a data root (not backups/)

2026-10-17 16:49:17 +02:00

quiesce

controller (unreleased): R-921 check-first pre-check (no stop while another tier's job is in flight); R-922 email_cleared on a household's deliberate clear

2026-10-09 12:57:34 +02:00

recovery

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

report

v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

2026-10-12 15:13:59 +02:00

scheduler

Operator actions in the report reply (D1, R-314/R-279/R-177, decision 185)

2026-10-08 14:49:27 +02:00

selftest

…

selfupdate

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

settings

v0.318.0: the internal data place, partitions, an honest whole-box backup offer (R-1084), sys_drive never offered (R-1082)

2026-10-16 03:57:49 +02:00

sockheal

…

stacks

v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data

2026-10-17 16:42:18 +02:00

sync

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

system

Media build part 1 (unreleased): real restart (R-1026), media apps on every PRESENT drive via an owned compose override (R-1023), dead-drive check from mountinfo, removal never deletes shared/:ro binds (R-1027), safety list knows userdata (R-1032), no drive question for media apps (R-1031)

2026-10-15 09:25:43 +02:00

util

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

web

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00