felhom-controller/REPORT.md

REPORT — v0.286.1: the box tells visitors apart (R-753, decision 63); R-772; R-773 — 2026-10-01 (night)

Full session report: felhom.eu/REPORT-visitors-2026-10-01.md. Evidence: felhom.eu/documentation/audits/visitors-2026-10-01/ (A = visitors apart, D = R-772/R-773, E = rollout). Architecture read: 01-topology-and-trust.md §5/§7, 09 §3 decisions 45–49, 57–63.

Baselines

controller c1b123c64955 (v0.285.0) → a28155f (v0.286.1). Agent unchanged (0.138.0; MinAgent 0.131.0).

Commits

1e8d045 R-753 · b53721d R-772 · 1e216d3 R-773 · d416742 v0.286.0 CHANGELOG/README · 79ef715 R-772 order fix (found live) · a28155f v0.286.1 CHANGELOG.

Tests and red-proofs

Full suite green (go build/vet/test ./..., rc 0) before each build; controller gates green (go-parity after the three new keys were registered). Red-proofs, each seen FAILING on the mutant: RP-A1 (leftmost hop), RP-A2 (the tunnel hop as the key), RP-A3 (no reconcile of a running traefik), RP-D1 (no-container record healthy), RP-D1b (the 0.286.0 order), RP-D2 (no lock on a restore) — files under audits/visitors-2026-10-01/{A,D}/RP-*.

Live

• 9202 (0.286.0, then 0.286.1, hand-set): simulated tunnel — a stranger's 5 wrong dashboard logins with a rotating forged leftmost address locked only him; the household from another address in at once; LAN/impostor forgeries counted as themselves. R-772: a stopped probe container read healthy false, not_checked true 14 s later (0.286.1). R-773: Karakeep removed + restored → opened_by: restore, stranger /signup 403 and users.create 403, data back.
• Both demo boxes (floor 0.286.1, min_agent 0.131.0): each made felhom-tunnel, wrote the clean-up file, recreated traefik and moved cloudflared to .2 by itself (~5 s). demo-hp's REAL tunnel: an app sees 6.6.6.6,37.191.56.193, 172.16.253.2; X-Forwarded-Host forged → gone; the dashboard counter keyed on 37.191.56.193, locked after 5. Every demo-hp app answers through the tunnel. ep0's one request was refused by Cloudflare's edge (403) before the box — the second outside address is unmeasured on the real tunnel (R-779).
• Golden 0.286.1 baked, round-tripped, vouched (golden 0.286.1 / agent 0.138.0 / min_agent 0.131.0); the hub then refused golden 0.285.0 (R-120). felhom.eu/documentation/tests/golden-0.286.1-2026-10-01/.

NOT validated live

• The app page's "not checked" line (render test only); R-773 on a block-only app (opengist/wishlist — same code path).
• A box rolling back below 0.286 with the new traefik (R-778, reasoned).