felhom-controller/REPORT.md

REPORT — v0.280.0: the setup gate (decision 46); "I changed it" (R-710); password fields off the page (R-709); a special-character generator (2026-09-29)

Architecture: felhom.eu/documentation/architecture/09-update-architecture.md §3 decisions 45–46, 01-topology-and-trust.md §5. Evidence: felhom.eu/documentation/audits/login-gate-2026-09-29/. Session report: felhom.eu/REPORT-login-gate-2026-09-29.md.

• Built only after the spike passed (B/B-VERDICT.md). setup_gate: true → a fresh install writes <stacks>/traefik/dynamic/setup-gate-<app>.yml BEFORE the first start (forwardAuth on every router the app's labels publish, priority 100000 + rule length); the answerer (/__felhom_gate/auth, before the host check) lets through only a host-bound gate cookie, minted after a valid dashboard session on felhom.<domain>/__gate/start (60 s one-use token). The loop (20 s) opens a gate when setup_done_probe: flips; „Kész, beállítottam" opens one without a probe.
• Tests: stacks TestSetupGate_* (9), TestGenerateValue_PasswordWithASpecialCharacter; web TestSetupGate_* (4), TestSetupGatePage_*, TestKnownLogin_*, TestR709_*. go build, go vet, go test ./... green; controller gates green; parity fixtures: 4 new cases, 6 deploy fixtures regenerated (diff = the R-709 lines and the generator only).
• Red-proofs RP1–RP16, each seen failing on an assertion (C/redproofs/).
• Live on 9202 (drill catalog): immich, n8n, audiobookshelf (probe), uptime-kuma (button) — 0 app answers to a stranger before each gate opened; the household in 0.2 s; a restart kept a closed gate and the household's pass; immich's phone-app API unchanged after. mealie, wger, calibre-web: default refused, generated signs in. R-709: the revealed value is not in the settings page. Delivered: floor 0.280.0; demo-hp and demo-felhom run it; demo-hp's "I changed it" pressed on bookstack and calibre-web (the operator's ruling).
• Not live: a restore of a gated app (test only; R-648 forbids the whole-box backup a drill would need).
• MinAgent 0.131.0 (unchanged).