Runtime fixes 2026-10-28 close-out: lane batches 3+4 live (papra, dawarich, adventurelog), R-1332 closed (10 live / 4 big step / 6 no fix), TABLE final, AdventureLog runs 2-4 evidence, 9202 back on the live catalog; CONTEXT, STATUS, REPORT

documentation/backlog/CLOSED-ITEMS.md

@@ -26,13 +26,14 @@
 
 ---
 
-## 2026-10-28 (day) — R-1313, R-1322 and R-1327 closed: Wanderer hidden, Immich's lane step live, the runtime watch fills its own cache in CI (full text of the rows: `git show 9b4b5fe5:documentation/backlog/OPEN-ITEMS.md`)
+## 2026-10-28 (day) — R-1313, R-1322, R-1327 and R-1332 closed: Wanderer hidden, Immich's lane step live, the runtime watch fills its own cache in CI, the 20 runtime apps classified (full text of the rows: `git show 9b4b5fe5:documentation/backlog/OPEN-ITEMS.md`)
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
 | **R-1313** | **Wanderer (v0.20.0): a critical notice with no login — any remote ActivityPub server can overwrite its records (GHSA-fprh-3pp9-68m9); the fix is v0.21.2, a big step.** (P2) | CLOSED 2026-10-28 — D59 (`09` §3 decision 275) live: catalog `b5b78f6` sets `lifecycle: hidden` (CI job 2447 green); no box runs Wanderer. The big step v0.21.2 (with the fixed Node) carries on in R-1335. | `audits/http2shell-2026-10-27/wanderer-hidden.patch`, drill `ee18bff` |
 | **R-1322** | **Immich v3.2.4 (server + ML): the Node.js October 2026 runtime notice (CVE-2026-111497); the lane step to v3.3.5.** (P3) | CLOSED 2026-10-28 — the security-fix step v3.2.4 → v3.3.5 live: catalog `0158b50` (CI gates job 2448 green), on the operator's yes. Box 9202 `proven` (2026-10-27 night); the power-cut repair re-proven on v3.3.5 the same morning (4 of 4 rebuilt, 0 of 52 controls changed, the lost original reported) — `unclean-boot-images` had refused the step without it. | `audits/http2shell-2026-10-27/walks/immich/`, `audits/runtime-fixes-2026-10-28/immich-repair/` |
 | **R-1327** | **The security watch could not see a bug in the RUNTIME under an app (HTTP2Shell, CVE-2026-111497) — Home Assistant and RomM ran the bad code on the test boxes unseen.** (P2) | CLOSED 2026-10-28 — the watch reads every pin's runtime from the image (built 2026-10-27 night) and since `a3247d9f` reads zstd layers IN CI by itself (a hash-pinned `zstandard` 0.25.0 wheel, `09` §3 decision 278; no DooPlex change). The close condition held: the first full CI night (job 2446, 03:40) named Home Assistant 2026.9.4 and RomM 5.4.1 as ADVISORY (runtime) and audiobookshelf 2.37.2 as current. The self-fill: CI dry run job 2450 with HA 2026.9.4 and RomM 5.4.1 taken out of the cache read Home Assistant 2026.10.4 (zstd) in 87 s and RomM 5.4.1 (gzip) in 25 s, and answered audiobookshelf from the cache; the job took 3 min 34 s. Left to see: tonight's run is the first that COMMITS CI-read entries (a dry run does not) — STATUS asks for one look; Docker Hub's 429 is R-1334. | CI jobs 2446, 2449, 2450; `scripts/CHANGELOG.md` 2026-10-28; `08` §11 |
+| **R-1332** | **Twenty catalog apps ship a runtime with HTTP2Shell (CVE-2026-111497) inside their image — the first runtime read of the whole catalog.** (P2) | CLOSED 2026-10-28 — every app is in one of three states, each fixed runtime READ FROM THE IMAGE: **10 live as security-fix steps** on the operator's yes per batch (home-assistant `b5b78f6`, immich `0158b50`; ghost, metube, zipline `abf3db3`; karakeep, tandoor `71e3fdf`; papra, dawarich `651a991`; adventurelog `0829994` — each box walk `proven` on 9202, CI green by hash); **4 need a new main version**, each on its big-step row (homepage R-1320, termix R-1311, wanderer R-1335, seerr R-1317); **6 have no fixed release**, each on its row with the exposure (actualbudget R-1336, calcom R-1329, calibre-web R-1337, paperless R-1331, romm R-1330, sparkyfitness R-785). The file manager (a box program) does not load libbrotli on any box (R-1305). | `audits/runtime-fixes-2026-10-28/TABLE.md`, `walks/` |
 
 ## 2026-10-27 (late evening) — R-1326 closed: the hub gets time to start (full text of the row: `git show 503692a1:documentation/backlog/OPEN-ITEMS.md`)
 

documentation/backlog/OPEN-ITEMS.md

@@ -124,7 +124,7 @@ stopping line that lies.
 | **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC |
 | **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator |
 
-## Apps & catalog — 25 rows (P2 2, P3 12, P4 11)
+## Apps & catalog — 24 rows (P2 1, P3 12, P4 11)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
@@ -150,7 +150,6 @@ stopping line that lies.
 | **R-1329** | Apps & catalog | P3 | **cal.com runs on Node.js 20, which gets no security fixes any more** — v6.2.0 carries Node 20.20.0 (no fixed release on the 20 line for CVE-2026-111497) and Debian 12's unpatched `libbrotli1` 1.0.9-2+b6 (fixed: 1.0.9-2+deb12u1); the same image runs in the catalog and on DooPlex. Read from the image 2026-10-27; 2026-10-28: v6.2.0 is still the newest tag, no Node 22/24 image (`audits/runtime-fixes-2026-10-28/TABLE.md`). | OPEN | — | a cal.com release on Node 22/24 (a big step: its own walk); until then the watch lists it nightly | CC |
 | **R-1330** | Apps & catalog | P2 | **RomM's newest release (5.4.1) still ships Node.js 24.18.1 (CVE-2026-111497, fixed 24.22.1)** — no newer RomM exists (tags read 2026-10-27). Exposure: Node is IN the image but no Node process runs (RomM serves through Python gunicorn/rq and nginx — `ps` on demo-hp 9201), and RomM sits behind the setup gate. | OPEN — **RULED D61 = keep RomM offered** (operator 2026-10-28, starting the day brief; `09` §3 decision 277): the first RomM release with Node ≥ 24.22.1 is a lane step. 2026-10-28: 5.4.1 is still the newest tag (read from the registry). Earlier: CC's pick 2026-10-27 night | — | the watch flags it nightly (R-1327); the step when RomM ships | CC |
 | **R-1331** | Apps & catalog | P3 | **Paperless-ngx 2.20.15 carries Python Brotli 1.1.0 (CVE-2026-111497, fixed 1.1.1/1.2.1)** — its web side only COMPRESSES (whitenoise, compression_middleware); the DECODERS are urllib3's and httpx's, for replies to requests Paperless itself makes (its own outbound calls), never for what a visitor sends. Read in the running container on demo-hp 9201, 2026-10-27. 2026-10-28: the newest release 3.3.4 still carries Brotli 1.2.0 and is a new main version — no fixed release yet (`audits/runtime-fixes-2026-10-28/TABLE.md`). | OPEN — no step tonight (decided by CC unattended — operator may reverse): the bad path needs a hostile server Paperless calls | — | take the first Paperless release with Brotli ≥ 1.2.1 as a normal step | CC |
-| **R-1332** | Apps & catalog | P2 | **Twenty catalog apps ship a runtime with HTTP2Shell (CVE-2026-111497) inside their image — the first runtime read of the whole catalog, 2026-10-27 night (R-1327):** actualbudget 26.9.0 (Node.js 24.20.0 → 24.22.1); adventurelog v0.13.0 (Node.js 26.3.0 → 26.12.1); calcom v6.2.0 (Node.js 20.20.0 → 22.23.4); calibre-web v4.0.8 (py-Brotli 1.2.0 → 1.2.1); dawarich 1.15.3 (Node.js 20.19.2 → 22.23.4); ghost 6.67.0-alpine (Node.js 22.23.3 → 22.23.4); home-assistant 2026.9.4 (py-Brotli 1.2.0 → 1.2.1); homepage v1.13.2 (Node.js 22.22.3 → 22.23.4); immich v3.2.4 (Node.js 24.21.0 → 24.22.1); karakeep 0.33.2 (Node.js 24.18.1 → 24.22.1); metube 2026.09.29 (py-Brotli 1.2.0 → 1.2.1); paperless-ngx 2.20.15 (py-Brotli 1.1.0 → 1.1.1); papra 26.6.2-rootless (Node.js 26.4.0 → 26.12.1); romm 5.4.1 (Node.js 24.18.1 → 24.22.1); seerr 2.7.3 (Node.js 22.18.0 → 22.23.4); sparkyfitness v0.17.3 (Node.js 24.18.0 → 24.22.1); tandoor 2.6.15 (Node.js 24.18.1 → 24.22.1); termix 2.8.0 (Node.js 26.9.0 → 26.12.1); wanderer v0.20.0 (Node.js 22.23.1 → 22.23.4); zipline 4.8.0 (Node.js 24.21.0 → 24.22.1). Plus one BOX program: the file manager `gtstef/filebrowser:1.5.8-stable` carries Alpine `brotli-libs` 1.2.0-r1 (a controller release when upstream rebuilds). None of these has a notice of its own. | OPEN — home-assistant and immich: lane steps walked tonight (drill, the live push waits for the operator); romm: R-1330; calcom: R-1329; paperless: R-1331; the rest: each app's next release whose image carries the fixed runtime, walked as a lane step — the watch lists them every night until then | — | per app: the first upstream image with Node ≥ 22.23.4 / 24.22.1 / 26.12.1 or Brotli ≥ 1.2.1, a lane step; close when the watch's runtime list is empty | CC |
 | **R-1336** | Apps & catalog | P3 | **ActualBudget has no release with the HTTP2Shell fix (CVE-2026-111497): 26.9.0 carries Node.js 24.20.0 and the newest 26.10.0 still Node.js 24.21.0 (fixed: 24.22.1), read from both images.** `node app.js` serves the app; the setup gate covers it until the first account exists, then its own password. No box runs it. `audits/runtime-fixes-2026-10-28/TABLE.md` | OPEN — filed 2026-10-28 (runtime fixes) | upstream: an image with Node ≥ 24.22.1 | the watch lists it nightly (R-1327); take that release as a lane step | CC |
 | **R-1337** | Apps & catalog | P3 | **Calibre-Web (v4.0.8, the newest) loads a bad Brotli decoder: its `cps.py` maps Python Brotli 1.2.0 (fixed 1.2.1), Pillow's libbrotlidec 1.2.0 and Debian's libbrotlidec 1.1.0** — read from the process's maps on demo-hp 9201 (`audits/runtime-fixes-2026-10-28/calibre-web-brotli.txt`). Exposure: the Python decoder is urllib3's, for replies to the app's own outbound calls (book metadata), not for what a visitor sends — the Paperless shape (R-1331). No fixed release exists. `audits/runtime-fixes-2026-10-28/TABLE.md` | OPEN — filed 2026-10-28 (runtime fixes) | upstream: an image with Brotli ≥ 1.2.1 | take that release as a lane step; Debian's libbrotli1 fixed version is not known (R-1327's table has no Debian line) | CC |