admin
e30091bf27
gates / gates (push) Failing after 1m2s
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
27 lines
2.1 KiB
Markdown
27 lines
2.1 KiB
Markdown
# REPORT — v0.328.0: the catalog allow-list (R-971, operator decision D2 = A) (2026-10-17)
|
||
|
||
Written in ASD-STE100 Simplified Technical English. Session report: felhom.eu `REPORT-agent-allowlist-rotation-2026-10-17.md`.
|
||
Evidence: felhom.eu `documentation/audits/agent-allowlist-rotation-2026-10-17/P2/`, `P5/`.
|
||
|
||
- **What:** `internal/privpolicy` checks the RENDERED compose before every compose write and env decision (sync,
|
||
update/ladder step, install, two settings changes, two restores — before the stop) against `allowlist.json`
|
||
(go:embed; one entry: homepage's read-only socket, bound to its image, start and healthcheck). Refusal: nothing
|
||
written, operator event `app_definition_refused` (hub ≥ v0.157.0), app-page line, plain message. Sync never copies a
|
||
template named like an infra stack.
|
||
- **Tests:** `privpolicy_test.go` (every class, positive controls, the three review rounds, the live root finding),
|
||
`TestAllowList_IsWiredIntoEveryComposeWriter` (AST), `sync.TestR971_*`, `stacks.TestAllowList_*`,
|
||
`TestR971_AppPage_*`; full suite green on `99f9117`. Red-proofs in P2.
|
||
- **i18n:** new fixture `app_settings_definition_refused`; every other fixture byte-identical. Keys
|
||
`err.stacks.definition_refused`, `app_info.definition_refused` in both bundles.
|
||
- **Release:** rc.1–rc.5 on demo-hp 9201; 0.328.0 to Tester 1, demo-hp, demo-felhom by per-box floors (all three in
|
||
< 1 min), box walk green (0 refusals, all containers healthy, login and files 200), https-only green; global floor
|
||
0.328.0, MinAgent 0.158.1; per-box floors cleared; read back from the hub DB with its WAL.
|
||
- **9201 proof:** drill catalog with `privileged: true` on privatebin → refused; compose sha and container unchanged;
|
||
event at the hub + operator mail; page line on privatebin only; live catalog restored byte-identical.
|
||
|
||
## Observations
|
||
|
||
1. rc.4 refused every not-installed app on the box (placeholder roots do not exist there). NOT-A-FINDING: found by this session's own live proof and fixed in rc.5 before the release, red-proved.
|
||
2. One app can still bind another app's `appdata/<name>`. FILED: R-1142.
|
||
3. `build.sh` pushes `:latest` with every build, rc included. FILED: R-1143.
|