felhom-controller/REPORT.md

REPORT — controller v0.76.0: campaign-#3 hardening (3 fixes)

Baseline → target

felhom-controller main v0.75.0 → v0.76.0. Controller-only; agent/hub untouched.

What changed (commit b0dd131)

Three findings from chaos campaign #3, severity-ordered:

• S1 [MEDIUM] — corrupt settings.json no longer crash-loops the controller. internal/settings/settings.go: save() writes a last-known-good <path>.bak after the primary rename succeeds (best-effort). Load() on a parse error recovers from .bak (re-promotes to primary), else preserves the corrupt file as *.corrupt-<ts> and starts on safe defaults — never returns the error that drove main.go's Fatalf/crash-loop. New Settings.LoadWarning → dashboard banner (handlers.go + dashboard.html). main.go Fatalf retained (now only the IO-unreadable path).
• F2 [MEDIUM, defense-in-depth] — stack_name validated against path traversal. internal/web/validate.go validStackName (single segment; rejects / \ .. NUL), gated in backupRestoreHandler (handlers.go) and apiExportStart (handler_export.go) before any restore/export work.
• S3 [LOW] — corrupt quiesce marker quarantined, not silently dropped. internal/quiesce/quiesce.go readMarker logs a [WARN] + renames a bad-JSON marker to *.corrupt-<ts> (still returns "no marker" → no recovery, the correct contract).

Tests (green; all red-proofed)

go build ./... && go vet ./... && go test ./... — green.

• T-S1a recover-from-bak, T-S1b unrecoverable→safe-defaults+preserve, T-S1c save-writes-bak, T-S1d happy. Red-proof: revert Load to error-on-parse → T-S1a/b FAIL.
• T-F2a validStackName (pure), T-F2b restore handler rejects traversal (no nil-deref), T-F2c export handler → 400. Red-proof: drop the restore gate → traversal falls through to the nil-backupMgr redirect → T-F2b FAIL.
• T-S3a quarantine+log, T-S3b happy. Red-proof: revert readMarker to silent → T-S3a FAIL.

Deploy

Built+pushed :0.76.0 on 192.168.0.180 (build-server git pull done first), deployed to 9201 via bootstrap. docker inspect: image=:0.76.0 running healthy.

LIVE re-test — the three campaign-#3 scenarios, now fixed

1. S1: ensured .bak, truncated settings.json → restart → status=running RestartCount=0 (no crash-loop), logs [ERROR] primary settings corrupt … — attempting recovery from .bak → [WARN] recovered settings from .bak; re-promoting to primary; config intact (3 storage_paths), 25/0.
2. F2: POST /backup/restore stack_name=../../../etc → flash_error=Érvénytelen alkalmazásnév, log [WARN] restore rejected: invalid stack_name "../../../etc", no "Starting app-data restore" (gate fired before the restore logic); /etc/passwd intact (24 lines).
3. S3: planted a corrupt quiesce-state.json → restart → [WARN] [quiesce] marker … is corrupt … — quarantining; stacks not auto-recovered, original renamed to *.corrupt-<ts>, RestartCount=0, 25/0 (stacks not stranded).

Still-open campaign-#3 deferrals (NOT in this task)

Time-chaos on a dedicated VM / injectable clock; host-reboot (supervised); .fab import compose-fuzzing. Agent/hub untouched.