felhom-controller/REPORT.md

REPORT — v0.287.0: the family gate (decisions 63/64, R-780) — 2026-10-02

Full session report: felhom.eu/REPORT-family-gate-2026-10-02.md. Evidence: felhom.eu/documentation/audits/family-gate-2026-10-02/ (A = the controller live on 9202, B = the catalog apps on 9202, B4 = a demo box, E = the floor). Architecture read: 01-topology-and-trust.md §5 (now with the family gate paragraph), 09 §3 decisions 46, 47, 63, 64.

What shipped (v0.287.0, commits 977665d + c8d5ee2)

• internal/family — the household's family members: own name + password each (4×4 letters, shown once, bcrypt in family.json 0600), sessions of 30 days, asked on EVERY request (Valid), so reset / remove / logout end access at the next request. A wrong name costs the same bcrypt time as a right one.
• internal/stacks/family_gate.go — a template's family_gate: true gets a traefik forwardAuth door per router, written BEFORE the first start (an app is never published open); family_gate_except: literal prefixes become routers without the door, anchored ^/prefix(/|$) (finding F1); the record is written at install and at a removed app's restore; the tick rewrites/removes the files. min_controller: refuses a template that needs a newer box.
• internal/web/family_gate.go — /__felhom_gate/family (forwardAuth), /__family/start|login|logout on the dashboard host; the family cookie (Path=/__family) is NEVER accepted by RequireAuth; the sign-in locks per visitor (5/min, via rateKey, R-753) and per name (10/10 min). The Család card (Settings → Security): add / new password / remove, password once, no-store. hu + en, informal „te", no „kérjük"; parity green.

Proof

• Tests: internal/family/family_test.go, internal/stacks/family_gate_test.go, internal/web/family_gate_test.go. Red-proofs RP-F1..F7 (each mutant made its named test fail, then reverted): A/RP-F-family-gate-mutants.txt. Full suite rc 0; controller_gates.py OK.
• Live on 9202 through the product (A/items.txt): a stranger 0 app answers of 36 (LAN + simulated tunnel); members in with their own logins, the websocket 101; reset/remove/logout end access at once; a stranger's 7 guesses locked only the stranger; each Grimmory exception kept Grimmory's own login and the look-alikes stayed gated; the controller down → 500, never the app; the gate's own cost 0.49 ms median. Survived an Update and a remove + restore (B/box/).
• Floor 0.287.0 (min_agent 0.131.0): both demo boxes on 0.287.0 in ~25 s (E/floor.txt). Golden 0.287.0 baked, round-tripped, vouched (felhom.eu/documentation/tests/golden-0.287.0-2026-10-02/).