Session close: REPORT-visitors-2026-10-01, STATUS (go/no-go: the family gate; SparkyFitness licence), CONTEXT, capability map rows, R-783..R-787 (register 422)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-01 22:19:50 +02:00
parent 09ae93db05
commit 27f4e7d976
5 changed files with 197 additions and 47 deletions
@@ -16,6 +16,16 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.


+> **2026-10-01 (late night) — the box tells visitors apart (R-753 CLOSED), controller v0.286.1 floored, golden 0.286.1
+> vouched.** cloudflared alone on `felhom-tunnel` at `172.16.253.2` (traefik `.3`; allocation confined to `.4/30`); traefik
+> trusts forwarded headers from that address only and strips client-writable host/path/address headers
+> (`felhom-forwarded@file`); the controller reads the hop traefik saw (`clientaddr.go`). **Readers take the visitor from the
+> RIGHT** — 19 catalog apps that read the leftmost carry `<router>-xff`; BookStack `APP_PROXIES`; checklist 3.10. R-772
+> (not-checked probe) and R-773 (lock after a restore) closed. Permanent family gate SPIKED and PASSED, not built (R-780,
+> operator go/no-go, 2 sessions). SparkyFitness record added; its licence is non-commercial only (R-784, operator); a catalog
+> licence sweep is owed (R-787). `01` §7 corrected: cloudflared runs in the guest (R-754). Report:
+> `REPORT-visitors-2026-10-01.md`.
+
 > **Ruling 2026-10-01 (evening, operator) — `09` §3 decision 63, recorded before the work.** Login problems are solved by
 > EXTENDING THE BOX'S OWN GATE (option A), not by an identity app on every box (option B, Authentik/Authelia — a possible
 > later step behind the same traefik `forwardAuth` hook). Order: the box tells visitors apart (R-753) → a SPIKE of a