felhom-controller/REPORT.md

REPORT — controller v0.333.0 (2026-10-19, second day brief)

Shipped and the floor for every box (10:16 UTC, MinAgent 0.158.1), after Tester 1, demo-hp and demo-felhom took it by the normal update path (per-box floors 09:59 UTC; all three on 0.333.0 within about a minute, demo-hp from rc.2 at its next report) and the box walk was green on all three. Image 0.333.0 digest sha256:f150a8d8cd329f5cde9e34249e34edc59b6b5db29db1e3200900f3869a0de11b, built from a6fa3c0. rc.1 and rc.2 ran on demo-hp 9201 only.

• R-1155 — FileBrowser's own token ends with the dashboard session. Measured first on demo-hp: the household user's FileBrowser token (HS256; claims belongsTo, Permissions, iat, exp = 2 h, iss) opened /api/users?id=self (200) after the dashboard sign-out, as a cookie and as a Bearer header. Now the forwardAuth answer refuses a request with no valid files cookie that carries a non-admin FileBrowser token, in every place FileBrowser 1.5.6 reads one (cookie, ?auth=, Bearer, Basic password). Live on rc.2 (demo-hp) and on 0.333.0 (Tester 1): with the files cookie 200; the token alone 401 in all four forms, before and after the sign-out; FileBrowser's sign-in page 200. Security review: the first version (c809dd3) missed Basic auth — FileBrowser takes a Basic-auth password as the token. Fixed in a6fa3c0 before any release; red-proved (Basic → 200 without the branch).
• R-1161 — the recovery-code page: the reveal now says the code becomes live after the two words come back, and that closing the page keeps the old code; the old sentence shows only for an agent before 0.160.0. Live on demo-hp: the new text shown, the old one hidden, the switch present, a negative control absent. Fixtures re-captured: escrow_first, escrow_receremony; all others byte-identical.
• The Chrome „Install" chip: NOT-A-FINDING — FileBrowser 1.5.6 has no setting that stops its web manifest (disablePWAInstall, already set, is the only PWA key).
• Box walk (felhom.eu documentation/audits/day-2026-10-19b/P6/): 0 unhealthy, 0 allow-list refusals, catalog in sync on all three; https-only 28 OK, 0 failures; „Fájlok ↗" with no second login on demo-hp and Tester 1, sign-out asks again.
• Residual: admin's password login on FileBrowser is pinned by a unit test (admin's token passes) and the sign-in page answers 200 live; a full admin sign-in was not walked live (CC holds no FileBrowser admin password).