hub-safety session: R-135/R-133/R-604/R-530/R-508/R-509/R-880 closed, R-861/R-173/R-518/R-519 narrowed, R-879/R-881 opened (336 → 332); 03 §3.1, 05 §16, golden 0.296.0, the hub-DB off-site plan, STATUS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,13 +1,61 @@
 # STATUS — what works, what's broken, what's next
 
-**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop, off at night) stayed offline all day; nothing
-was sent to it.**
+**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop, off at night) was offline again; nothing was
+sent to it.**
 
-**Updated 2026-10-05 (afternoon, the catch-up session): every box of ours healthy. Built and proven live: a box that was
-off at its backup time makes the backups up once when it comes back; the household's banner; the OS update repairs
-itself after a power cut (second crash on demo-hp, with your go). Report: `REPORT-catchup-2026-10-05.md`.**
+**Updated 2026-10-05 (late afternoon, the hub-safety session): every box of ours healthy. The hub refuses forged form
+posts and keeps the console passwords locked; the System page shows boxes left behind; the agent can no longer make
+itself root. Report: `REPORT-hub-safety-2026-10-05.md`.**
 
-## Today (2026-10-05, afternoon): a box that is not always on; the self-repair after a power cut
+## Today (2026-10-05, late afternoon): the hub's own safety; boxes left behind; the agent's admin rights
+
+**Decisions I took myself (you may reverse each — `09` decisions 119–124):**
+- A box behind the approved agent for 7 days raises an alarm to you; a global version raise that cannot move a box
+  sends you one mail naming it.
+- Scripts that post to the hub with the password must now send one extra header; a web page on another site cannot.
+- The console passwords are locked with the same key as the off-site passwords (one key to keep safe, not two).
+- The agent's rights are narrowed with exact rules and one checking helper, not one helper per command.
+- A cut-off backup is shown on the backup page until a backup runs all the way through.
+- A new agent whose root files add a file is delivered in two signed steps (the old box would refuse it in one).
+
+**What works now (proven live):**
+- **Form protection:** a password post without the header is refused (403); a browser on another site cannot add it.
+- **Console passwords locked:** all 4 were sealed at the hub's start; the demo-hp one still opens its Proxmox (checked).
+- **Boxes left behind:** the System page lists the three per-box version floors and shows Tester 2's agent 4 releases
+  behind. The alarm and the mail are proven by tests only (they need 7 days / a global raise).
+- **The agent cannot make itself root any more:** before, the real sudo let 23 of 29 attack commands through; now 0, on
+  demo-hp and demo-felhom, and every agent feature still passes its check (67 of 67) on all three boxes.
+- Agent 0.146.1, controller 0.296.0 and hub 0.135.0 on demo-hp, demo-felhom and Tester 1; new-install image 0.296.0.
+
+**Found today:**
+- **The hub database is backed up — but only inside DooPlex**, and only because a hand-set label says so; nothing tells
+  anyone if that backup fails. (Your decision below.)
+- **A new agent's root files could not reach any box in one step** (an older box refuses files it does not know). Fixed
+  with a two-step delivery; written down for next time.
+- **A security review of my own agent change found three holes** before it went to any box; fixed in a second agent
+  release (0.146.1). Two agent releases today, against "one per repo" — the first was never sent anywhere.
+- **The backup page already said "about 8 minutes"**, not "a few seconds". Measured today on demo-hp (9 apps): about 6
+  minutes. Both figures are on the page now.
+
+**Needs you:**
+1. **Where the hub database's off-site copy goes** (it holds every box's keys and your customers' settings):
+   - **A — my pick: ep0's backup server**, encrypted on DooPlex before it leaves, with a weekly restore test and an
+     alarm mail. Costs one small change on ep0 (a write-only account) and keeping two keys in your password manager.
+   - **B: a separate Hetzner Storage Box account** with restic. More new parts to look after than A.
+   - **If you decide nothing:** the database stays only on DooPlex. A fire or theft there loses every box's console
+     password, the escrow records and the customer settings; each box would need re-pairing by hand. Steps:
+     `documentation/runbooks/RUNBOOK-hub-db-offsite-backup.md`.
+   - **Either way, first:** put the hub's lock key (`OFFSITE_SECRET_KEY`) in your password manager — without it a copy
+     of the database cannot open the console passwords.
+2. **The power-cut-during-backup check (R-519) on the scratch box:** the permission check refused my restarting the
+   controller in the middle of a backup. Say "go" and the next session does it once on 9202; if not, the fix stays
+   proven by tests only.
+3. **Three things the agent can still do, by design** (each written in `03` §3.1): pick which controller image its own
+   guest runs; install the operator SSH key for the limited `felhom-op` user; see the box's backup key during the
+   recovery-code ceremony. If you do nothing, they stay as they are until before the first paying customer.
+4. **Tester 2's one-time step** is unchanged (below).
+
+## Earlier today (2026-10-05, afternoon): a box that is not always on; the self-repair after a power cut
 
 **Decisions I took myself (you may reverse each — `09` decisions 112–118):**
 - The make-up run starts 15 minutes after the box comes back; a backup due within 30 minutes is left to its normal time.