felhom-controller/REPORT.md

REPORT — v0.328.0: the catalog allow-list (R-971, operator decision D2 = A) (2026-10-17)

Written in ASD-STE100 Simplified Technical English. Session report: felhom.eu REPORT-agent-allowlist-rotation-2026-10-17.md. Evidence: felhom.eu documentation/audits/agent-allowlist-rotation-2026-10-17/P2/, P5/.

• What: internal/privpolicy checks the RENDERED compose before every compose write and env decision (sync, update/ladder step, install, two settings changes, two restores — before the stop) against allowlist.json (go:embed; one entry: homepage's read-only socket, bound to its image, start and healthcheck). Refusal: nothing written, operator event app_definition_refused (hub ≥ v0.157.0), app-page line, plain message. Sync never copies a template named like an infra stack.
• Tests: privpolicy_test.go (every class, positive controls, the three review rounds, the live root finding), TestAllowList_IsWiredIntoEveryComposeWriter (AST), sync.TestR971_*, stacks.TestAllowList_*, TestR971_AppPage_*; full suite green on 99f9117. Red-proofs in P2.
• i18n: new fixture app_settings_definition_refused; every other fixture byte-identical. Keys err.stacks.definition_refused, app_info.definition_refused in both bundles.
• Release: rc.1–rc.5 on demo-hp 9201; 0.328.0 to Tester 1, demo-hp, demo-felhom by per-box floors (all three in < 1 min), box walk green (0 refusals, all containers healthy, login and files 200), https-only green; global floor 0.328.0, MinAgent 0.158.1; per-box floors cleared; read back from the hub DB with its WAL.
• 9201 proof: drill catalog with privileged: true on privatebin → refused; compose sha and container unchanged; event at the hub + operator mail; page line on privatebin only; live catalog restored byte-identical.

Observations

1. rc.4 refused every not-installed app on the box (placeholder roots do not exist there). NOT-A-FINDING: found by this session's own live proof and fixed in rc.5 before the release, red-proved.
2. One app can still bind another app's appdata/<name>. FILED: R-1142.
3. build.sh pushes :latest with every build, rc included. FILED: R-1143.