answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

- 09 §3: the decision sheet S1-S38, the operator's words quoted where they differ (S1, S2, S8, S32, S37) - closed: R-831 R-870 R-698 R-327 R-230 R-719 R-352 R-526 R-770 R-771 R-913 R-290 R-209a R-769 R-616 R-884, and R-243 (dated check: the mail fired 2026-10-11 16:13:51Z, hub log agrees) - R-698: the known limit written in 07 §6.6; new row R-933 (mirror supported catalog images, P3) - R-327: capability-map row BUILT; stands claim re-titled and moved to built; page re-rendered - R-913: the customer Cloudflare token recipe in day0-install A.1; 01 §7 points at it - R-884: read only - ArgoCD Synced, live Deployment equals git - R-887 dated check NOT met (4 lost jobs 10-10/11); re-dated 2026-10-19 after the S21 change - 22 open rows carry their ruling; STATUS: the sheet is ANSWERED Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-12 14:07:50 +02:00
parent 25ab47eeaa
commit 1b45bb4d9b
12 changed files with 184 additions and 63 deletions
@@ -3,7 +3,16 @@
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**

 **Updated 2026-10-11 (M3 live): hub 0.146.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
-0.307.0. The open-items list is at 129 (was 127). Reports: `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+0.307.0. The open-items list is at 112 (2026-10-12: your 38 answers, 17 closed). Reports: `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+
+## Monday 2026-10-12 (afternoon): your 38 answers — written down, and 16 items closed
+
+- **All 38 answers are written down** in the decisions list (numbers 196–233). Where your words differed from my pick (S1, S2, S8, S32, S37), your words are the rule.
+- **The list went from 128 to 112.** 17 items closed with no code: the ones you accepted, the ones that are by design, and the apps you said no to. One new item: mirror the images of every app we support into our own registry, before we grow (your S8 note).
+- **The hub mailed you on time that Tester 2 never made an off-site copy** (Sunday 18:13). That check is closed.
+- **Prometheus on DooPlex is in sync** (S37). I read it once, read only: ArgoCD says Synced, and the live settings equal git.
+- **The Cloudflare token recipe is in the install runbook** (S31): two permissions, one zone, nothing else.
+- **What remains of the sheet, in order:** the four DooPlex changes (I ask you in chat before each), one hub release (you present for the deploy), one box release, Glance behind the family gate, the capability map, the notification-settings design, and last the six hub readers.

 ## Monday 2026-10-12 (night): the laptop on the home page is playing

@@ -121,7 +130,7 @@
 - **Good news found on the way:** DooPlex's saved login for the image registry works again, so builds push normally.
 - **Not done:** no hub release and no agent release (none was needed). The R-925 work and its Secrets were not touched.

-### The decision sheet (2026-10-10 afternoon) — answer „all as picked", or name the numbers you change
+### The decision sheet (2026-10-10 afternoon) — ANSWERED 2026-10-12 13:50 (`09` §3 decisions 196–233; your words win where they differ: S1, S2, S8, S32, S37)

 Each line: the question, **my pick**, what the other option costs, what happens if you do nothing. The full reasoning is in each row of `OPEN-ITEMS.md`.

@@ -222,7 +222,9 @@ app. Controller down → the gated app answers an error, never the app. Measured
  customer added later would be reachable). Cloudflare unreachable → the save fails and the old token stays. The token
  is never logged. **Limit:** `/zones` lists what the token can READ; a hand-built token with Zone:Read on one zone and
  DNS:Edit on all zones would pass — the token wizard's single „Specific zone" scope does not build that, and a
-  customer token cannot read its own policies. Tokens saved before this check are checked the first time each config
+  customer token cannot read its own policies. **The guard for the write side is the recipe, not a check** (operator
+  ruling 2026-10-12, S31, `09` §3 decision 226): the operator mints every customer token from the one recipe in
+  `runbooks/day0-install.md` A.1, and the hub checks nothing more. Tokens saved before this check are checked the first time each config
  is saved with a new token or domain.
 - **Tunnel placement: INSIDE the guest** (corrected 2026-10-01, R-754 — the operator's brief of that evening: the build is
  right, correct the document). `cloudflared` is a container the CONTROLLER renders and keeps up (`internal/infra`,
@@ -875,7 +875,11 @@ requires a database dump written after the conversion whose recorded engine is t

 **[FACT] The limit — the image is not in the backup (R-698).** A unit stores image NAMES and digests; the
 image is re-pulled on restore. A version its maker has deleted cannot start. Measured 2026-09-26: the 42 ladder
-digests all resolve today (`audits/version-travel-2026-09-26/A7/`). Options are in R-698; nothing is decided.
+digests all resolve today (`audits/version-travel-2026-09-26/A7/`). **Accepted as a known limit — operator ruling
+2026-10-12 (S8, `09` §3 decision 203; R-698 closed).** What a household meets: a restore whose version the maker has
+deleted stops at the image pull, the app stays as it was, and the household uses another copy or a newer version.
+The operator's follow-up — *„will need to mirror the apps we support later, just to be sure"* — is **R-933**: mirror
+the images of every catalog app we support into our own registry, before scale. Until it is built, this limit holds.
 **Since decision 53 (`09` §3, 2026-09-30 evening):** a box keeps only the image each app service runs and the one before
 it; older images of the app are deleted. A restore that needs an older version re-pulls it — as before; the limit
 above is unchanged, and kept data (decision 40) is not touched by the image clean-up.
@@ -915,6 +915,70 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
     *Operator ruling 2026-10-05.* (R-861)

+### 2026-10-12 (13:50) — the decision sheet S1–S38 answered (recorded before the work; the „build the 38 answers" brief)
+
+The sheet: `STATUS.md` „The decision sheet (2026-10-10 afternoon)". Each line names the sheet number and the row. Where the
+operator's words differ from the sheet's pick, his words are quoted and they win. *Operator rulings 2026-10-12 13:50.*
+
+196. **S1 — R-922: the hub's registered customer address stays; only the box's notification address can be cleared.**
+     *„the customer can only delete their email address in the controller, from the notification address. If they do that,
+     they won't get any more notifications (maybe a warning popup?). However in the HUB each customer needs an email
+     address, and the user can't delete that, so the HUB can reach the user if needed (accounting, or any other reason)."*
+     So: a warning before the household clears its notification address (controller), and the privacy-notice draft says
+     why the registered address is kept.
+197. **S2 — R-831: the Hetzner storage token stays valid (option A, accept).** The sheet's pick was „rotate"; the operator
+     chose A. Row closed as accepted.
+198. **S3 — R-870: Tester 1's two leaked Cloudflare tokens are accepted;** they are rotated when Tester 1 is retired.
+199. **S4 — R-242: a hub alarm when the newest baked golden is not vouched,** before the first external install.
+200. **S5 — R-388: the household notification settings are redesigned to „only what you can act on" — designed now,
+     built in slices later.**
+201. **S6 — R-244: the hub removes a deleted customer's id from shared app-log issue rows, and sweeps once** (the count
+     is shown before the sweep).
+202. **S7 — R-264: CC owns the six owed hub readers (decided 2026-08-12) and builds them when the queue is idle.**
+203. **S8 — R-698: a restore of a version whose image the maker deleted cannot start — accepted as a known limit**
+     (`07` §6.6), row closed. *„Will need to mirror the apps we support later, just to be sure"* → new row R-933 (P3):
+     mirror the images of every catalog app we support to our own registry, before scale.
+204. **S9 — R-255: one test renders every dashboard page with planted secrets and fails if any shows.**
+205. **S10 — R-266: „disk reading failed" is carried to the hub,** so it is not read as an empty disk (hub + controller).
+206. **S11 — R-333: no heat band for NVMe;** the drive's own critical warning still alarms.
+207. **S12 — R-577: guest share pages get the language globe** (the visitor's own cookie).
+208. **S13 — R-327: the code-naming arc is „built" in the capability map;** CC rewrites the title. Row closed.
+209. **S14 — R-230: dated history entries in the memory index may keep version numbers;** (a) closed, the pilot (c)
+     dropped. Row closed.
+210. **S15 — R-719: the expired self-bind link's „Új linket kérek" shape is accepted.** Row closed.
+211. **S16 — R-352: hot data in the guest, bulk data on a drive, is by design.** Row closed.
+212. **S17 — R-526: no „release only the PBS token" operation on ep0** — the R-511 adopt path already reuses the kept
+     token. Row closed.
+213. **S18 — R-213: „see what a restore would change" is designed after the first customers.** Row stays open, P4.
+214. **S19 — R-288: one session restructures the capability map** — one status line per capability with a dated pointer
+     to its evidence. Documentation only.
+215. **S20 — R-231: DooPlex's backup scripts (`/opt/backup/scripts`) go into a repo with an install script;** the
+     operator is present for the install.
+216. **S21 — R-887: raise the act-runner's fetch timeout and rate-limit the public Gitea pages the crawler walks**
+     (DooPlex; each change after the operator's yes in chat).
+217. **S22 — R-886: `fsGroup: 65534` for Alertmanager;** a silence must be proven to survive a pod restart.
+218. **S23 — R-211: the Prometheus config-reloader sidecar** (DooPlex, after the operator's yes in chat).
+219. **S24 — R-770: no Invidious.** Row closed.
+220. **S25 — R-771: no moonlight-web.** Row closed.
+221. **S26 — R-782: Glance goes behind the family gate,** like Grimmory.
+222. **S27 — R-554: `recovery-info.txt` points at the dashboard's Restore page and the recovery code; then the obsolete
+     setup wizard is deleted.** The operator approves the Hungarian text before it ships.
+223. **S28 — R-562: Hungarian dates and numbers in Hungarian (decimal comma, `2026. 10. 10. 15:04`), ISO-like in English.**
+224. **S29 — R-250: the off-site setup scan prefers IPv4 and waits longer, and its error says „safe to press again".**
+225. **S30 — R-246: the hub's `stale_at` column is retired.**
+226. **S31 — R-913: the operator mints every customer Cloudflare token from one recipe; the hub checks nothing more**
+     (option a). The recipe: `runbooks/day0-install.md` A.1. Row closed.
+227. **S32 — R-521: one mail per lost drive to the household, in its language — *„if there is a notification option in the
+     controller settings, and enabled"*.** So the mail goes only when the household's own notification settings carry
+     that option and it is switched on (hub + controller).
+228. **S33 — R-402: one line on the hub's host page: „Last full check: OK/FAILED, depth N, date".**
+229. **S34 — R-290: folded into R-288** (the map restructure cites an evidence file for every green row). Row closed.
+230. **S35 — R-209a: accepted until a planned reboot;** the next planned DooPlex reboot checks the SSD2 move. Row closed.
+231. **S36 — R-769: no Pinchflat.** Row closed.
+232. **S37 — R-884: *„Fixes, can be closed"*** — CC reads the ArgoCD state for Prometheus once, read only; Synced → close
+     with the evidence, drift → one line for the operator and the row stays.
+233. **S38 — R-616: the Gitea admin token the catalog clone exposed was rotated (in the R-925 work).** Row closed.
+
 ### 2026-10-10 — operator ruling: the kernel approval rule (recorded before the work; the release brief)

 195. **„Approve kernel set" offers the NEWEST kernel version that EVERY ring-0 box has booted healthily at least once
@@ -126,16 +126,18 @@ claims:
  - id: claim.code-naming
    band: journey
    stage: 2
-    title: "The same word is used for two different secrets across three surfaces; the email points at a page a rebuilt machine does not show"
-    status: partial
-    note: "Warning card. Cost a real code on 2026-08-09."
+    title: "Each of the two secrets has one name on every surface, and the re-enrol mail points at a page a rebuilt machine shows"
+    status: built
+    note: "Shipped (controller v0.211.0, hub v0.104.0/v0.105.0); no customer has typed the passphrase yet. Operator ruling 2026-10-12 (S13). The old defect cost a real code on 2026-08-09."
    sources:
      - register: "R-282"
-      - register: "R-283"
+      - register: "R-295"
+      - register: "R-323"
+      - register: "R-327"
    verified:
-      date: 2026-08-09
-      verdict: confirmed
-      depth: source-read
+      date: 2026-10-12
+      verdict: upgraded
+      depth: register+map
  - id: use.catalog
    band: journey
    stage: 3
@@ -0,0 +1,7 @@
+# R-243 dated check, read 2026-10-12 ~12:05Z
+channel 1 (operator mailbox, Gmail connector): thread 1a12bbe0e6599a61, from monitoring@felhom.eu to admin@felhom.eu,
+  2026-10-11T16:13:51Z, subject "[Felhom] ⚠️ Tester-2: offsite_escrow_pending",
+  "Customer Tester-2: off-site backup is ON but has not run for 168h0m0s since the box first ..."
+channel 2 (the running hub pod, kubectl logs deploy/hub --since=30h):
+  2026/10/11 18:13:51 [INFO] Operator email sent for Tester-2/offsite_escrow_pending
+Expected: first sweep after 2026-10-11 ~16:06Z (anchor = Tester 2's first report). Fired 16:13:51Z.
@@ -0,0 +1,10 @@
+# R-884 read-back, 2026-10-12 (read only)
+Mon Oct 12 11:56:40 UTC 2026
+## channel 1: ArgoCD Application monitoring
+sync=Synced health=Healthy rev=eeb009f790f8495d72434aa3500f8e1de391c6a0 reconciledAt=2026-10-12T11:52:32Z
+resources 29 not Synced: []
+prometheus Deployment: ['Synced']
+## channel 2: the live Deployment vs git (homelab-manifests eeb009f, mon-system/monitoring.yaml)
+git image prom/prometheus:v3.15.0, live image prom/prometheus:v3.15.0
+live args ["--config.file=/etc/prometheus/prometheus.yml","--storage.tsdb.path=/prometheus","--storage.tsdb.retention.time=60d","--storage.tsdb.retention.size=19GB","--web.enable-lifecycle","--web.enable-admin-api"]
+git args identical (6 flags, compared by script 2026-10-12 11:55Z)
@@ -26,6 +26,30 @@

 ---

+## 2026-10-12 (afternoon) — the operator's 38 answers (sheet S1–S38): the rows that need no code
+
+The full text of the rows below: `git show 25ab47eeaa:documentation/backlog/OPEN-ITEMS.md`. Evidence: `documentation/audits/answers-2026-10-12/` unless a row names another place.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-243** | **A box in the R-241 state silently stops backing up off-site, and NO ALARM OF ANY KIND FIRES.** (P2) | CLOSED 2026-10-12 — **the alarm fired on time.** The `offsite_escrow_pending` mail for Tester-2 reached the operator mailbox 2026-10-11 16:13:51Z (the first sweep after the 7-day line, ~16:06Z); the running hub logged „Operator email sent for Tester-2/offsite_escrow_pending" at the same second. Two channels. | hub v0.144.0+ (`b119301c`); `r243-escrow-pending-mail.txt` |
+| **R-831** | **The Hetzner storage API token (`HETZNER_TOKEN`, the storage project's token in `Secret/storagebox`) was printed into the 2026-10-03 session transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S2, `09` §3 decision 197): **A — accept.** The Hetzner storage token stays valid. | the ruling |
+| **R-870** | **Tester 1's two Cloudflare credentials — the zone API token (`infrastructure.cf_api_token`) and the tunnel token (`infrastructure.cf_tunnel_token`) of the hub's `customer_configs` row `tester-1` — were printed into the 2026-10-04 night session's transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S3, `09` §3 decision 198): **accepted**; rotate when Tester 1 is retired. | the ruling |
+| **R-698** | **[P3-LOW] A backup stores the image's NAME, not the image — a restore of a version its maker has deleted cannot start.** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S8, `09` §3 decision 203): **accepted as a known limit**, written in `07` §6.6. The operator's follow-up (mirror the images of every supported catalog app) is the new row R-933. | `architecture/07-backup-architecture.md` §6.6 |
+| **R-327** | **The standing picture still describes a defect that has been fixed twice over.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S13, `09` §3 decision 208): **„built"**: a capability-map row added (status BUILT), the standing-picture claim `claim.code-naming` re-titled as a capability and moved to `built`, the page re-rendered. | `00-capability-map.md`, `where-felhom-stands.yaml`/`.html` |
+| **R-230** | **Three instruction/memory follow-ups deliberately left by the part-2 session (2026-08-06), each needing a decision rather than an implementation.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S14, `09` §3 decision 209): (a) **ruled: dated history entries in the memory index may keep version numbers**; (b) was closed 2026-08-06; (c) **the pilot is dropped**. | the ruling |
+| **R-719** | **[P2-MEDIUM] A customer who already exists never gets a fresh self-bind link when their new box registers: the last link expires in 7 days and nothing re-sends it.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S15, `09` §3 decision 210): **the „Új linket kérek" shape is accepted.** | the ruling; the shape shipped earlier (row text) |
+| **R-352** | **Four screens state something untrue about where an app's data goes, and the configured default is consulted by nothing that places data.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S16, `09` §3 decision 211): **by design**: hot data in the guest, bulk on a drive. The visibility fix shipped; R-368 fixed the comment. | the ruling |
+| **R-526** | **[P3-LOW] A host delete cannot release only the customer's ep0 PBS token: the endpoint's one removal op destroys every backup group too.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S17, `09` §3 decision 212): **no** — the R-511 adopt path already reuses the kept token. | the ruling |
+| **R-770** | **[P3-LOW] Invidious — fit check only; the recommendation is not to build it.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S24, `09` §3 decision 219): **no Invidious.** | the ruling |
+| **R-771** | **[P3-LOW] moonlight-web — fit check only; not buildable through an HTTP-only tunnel at usable latency.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S25, `09` §3 decision 220): **no moonlight-web.** | the ruling |
+| **R-913** | **The Cloudflare token check (R-138, decision 190) reads what a token can SEE, not what it can WRITE.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S31, `09` §3 decision 226): **(a)** — the operator mints every customer token from one recipe; the hub checks nothing more. Recipe written: `runbooks/day0-install.md` A.1; `01` §7 points at it. | `runbooks/day0-install.md` A.1 (recipe read from the hub and controller Cloudflare calls 2026-10-12) |
+| **R-290** | **Most capability-map rows that back a green dot cite no evidence document at all — measured, 20 of 28 probed.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S34, `09` §3 decision 229): **folded into R-288** (the map restructure cites an evidence file for every green row). | R-288 |
+| **R-209a** | **The SSD2 move has NOT survived a reboot, so by this project's own standard it is not fully validated** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S35, `09` §3 decision 230): **accepted until a planned reboot**; the next planned DooPlex reboot checks the SSD2 move (the mechanism is proven). | the ruling |
+| **R-769** | **[P3-LOW] Pinchflat is not built: upstream is paused (no release in 2026, last push 2025-12-16) and its last release has no image tag.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S36, `09` §3 decision 231): **no Pinchflat.** | the ruling |
+| **R-616** | **[P3-LOW] The catalog credentials are stored in PLAINTEXT in the box's catalog clone and are printed by an ordinary `git remote -v`.** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S38, `09` §3 decision 233): **the Gitea admin token the clone exposed was rotated** (operator's word, the R-925 work). The leak itself was fixed and read on every box 2026-10-10. | the operator's word 2026-10-12; `audits/register-shrink-2026-10-10/` (the 2026-10-10 clone read) |
+| **R-884** | **ArgoCD app `monitoring` shows `Deployment/prometheus` OutOfSync** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S37, `09` §3 decision 232): *„Fixes, can be closed"* — read once, read only: ArgoCD app `monitoring` Synced/Healthy, 29 resources, none OutOfSync, `Deployment/prometheus` Synced; the live Deployment's image and six args equal git (homelab-manifests `eeb009f`). Two channels. | `r884-prometheus-sync.txt` |
+
 ## 2026-10-10 (afternoon) — the register-shrink session: delivered rows read back, small fixes, the decision sheet

 The full text of the rows below: `git show 7413e0dfab:documentation/backlog/OPEN-ITEMS.md`. Evidence: `documentation/audits/register-shrink-2026-10-10/` unless a row names another place.
@@ -54,8 +54,23 @@ Tunnels):
   everything — cloudflared logs `No ingress rules were defined` (R-505). Make sure the domain is on
   Cloudflare (nameservers active).

-Also have ready (optional but recommended): a **Cloudflare API token** with Zone edit rights for the
-customer's zone — the hub uses it for geo-restriction management.
+Also have ready (optional but recommended): a **Cloudflare API token** for the customer's zone — the hub and the
+box use it for geo-restriction management.
+
+**The customer token recipe — the ONLY way a customer token is minted** (operator ruling 2026-10-12, S31, `09` §3
+decision 226; R-913). The hub's save check sees what a token can READ, not what it can WRITE (`01` §7), so the guard
+is this recipe. Cloudflare → My Profile → API Tokens → Create Token → **Create Custom Token**:
+
+| Field | Value |
+|---|---|
+| Token name | `felhom-<customer-id>` |
+| Permissions | `Zone` · `Zone` · **Read** — and `Zone` · `Zone WAF` · **Edit** (nothing else: no DNS, no Account permission) |
+| Zone Resources | **Include** · **Specific zone** · the customer's domain (never „All zones", never an account) |
+| Client IP filtering, TTL | leave empty |
+
+Why these two: the hub and the controller call only `GET /zones?name=…` and the zone's `rulesets` (read 2026-10-12:
+`hub/internal/cloudflare/unblock.go`, `felhom-controller/controller/internal/cloudflare/{zone,waf}.go`). Paste the token
+once into the customer's config; the hub then checks it sees exactly that one zone. Never reuse a token across customers.

 **„No TLS Verify" on the public hostname (R-510, 2026-09-15).** The route sends traffic to
 `https://traefik`, and traefik answers the name `traefik` with its own default certificate. Tick