felhom-controller/REPORT.md

REPORT — v0.322.0: the hub key opens no route, Go 1.27.2, the Data tab leftovers, the dead install-form branches (2026-10-16)

Written in ASD-STE100 Simplified Technical English. Task: burndown 2. Full report (the https close-out, the hub, the agent, the scanners, the rows): felhom.eu REPORT-burndown2-2026-10-16.md. Design: felhom.eu architecture/01-topology-and-trust.md §4 (now records R-970), 09-update-architecture.md §0. Evidence: felhom.eu documentation/audits/burndown2-2026-10-16/.

1. Plain words first

• The box's hub key opens no route any more. The routes that read and replaced the box's settings file are gone. The self-update and geo routes take only a logged-in session. Nothing called them with the key.
• New Go (1.27.2) and an updated Debian 12 base. Scanner counts fell: critical 16 → 4 (none fixable), fixable high 64 → 4 (all in Docker's own compose plugin), govulncheck 62 → 1 (a package not linked).
• The runtime stays on Debian 12, so restic stays 0.14.0. Debian 13 is its own row (R-1105).
• Data tab: the export password field tells the browser „new password", so it does not fill a saved one. The 2nd copy's status rows are gone; the form is the one place.
• The install form lost its branches for installed apps; no page served them.

2. Commits and images

8fe46a1 (v0.321.0) → f037be7 (R-970, Data tab, R-1103) → fc77fcb (Go 1.27.2) → 52619e8 (Debian 12.13) → e9d0d72 (CHANGELOG, apt-get upgrade) → this docs commit. Test images 0.322.0-rc.1 (Debian 13), -rc.2, -rc.3 (demo-hp only); release 0.322.0, MinAgent 0.158.1. Per-box floors for Tester 1, demo-hp, the N100, then the global floor 0.322.0, read back from the hub's page and its database.

3. Tests and gates

Red-proved: TestR970_HubKeyOpensNoDoor, TestR970_ConfigRoutesAreGone, TestR970_HubKeyIsNoCSRFExemption, TestAppData_OneBackupSection, TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin. Retired with the route: config_perms_test.go, the TestConfigApply_* tests. Retired with the branches (their rules named in the full report): TestDeployPage_DeployedApp_DoesNotCarryTheSecret, TestR709_AnInstalledAppsPasswordIsNotInThePage, TestR694_TheDeployPageDoesNotOfferAGeneratedLogin, parity cases deploy_installed, deploy_installed_restored. Green gate rc 0 on Go 1.27.2; controller_gates.py --fast all OK. Fixtures: 8 re-captured, 2 removed.

4. Observations

1. Debian 13 would move the off-site engine to restic 0.18.0 with assumptions measured on 0.14.0. FILED: R-1105
2. govulncheck names x/crypto/openpgp in the binary. NOT-A-FINDING: the program does not link it (go mod why); the report is module-level because the binary is stripped.
3. The parity case deploy_new_memory_blocked set „the current drive is missing" on a not-installed app. NOT-A-FINDING: test data only; the handler never does it, and the re-captured fixture shows what production renders.