REPORT: hub v0.84.0 deployed + endpoint-level live validation

REPORT.md

@@ -27,7 +27,12 @@ Modified:
 
 ## 3. Commits pushed to `main`
 
-*(filled in at push — see `git log --oneline`)*
+| Commit | What |
+|---|---|
+| `1956e5d` | hub v0.84.0 — break-glass console credential on the host page (code + tests + all docs) |
+| `edc7dcc` | manifests: hub 0.83.0 → 0.84.0 (Console access card) |
+
+Both fast-forwarded onto `origin/main` from `0a9bd38`. Trunk-based, no branch.
 
 ## 4. Test results + red-proofs
 
@@ -77,9 +82,45 @@ nothing reads would have been a hollow assertion.
 **550 → 559** (8 web + 1 store). Full suite `go build ./... && go vet ./... && go test ./...` in
 `hub/`: **rc=0, all 17 packages ok**. Run as a separate command from the commit, per standing rule 1.
 
-## 6. Deployed version
+## 6. Deployed version + live validation
 
-*(filled in after the build/manifest/sync steps)*
+**Deployed.** Image `gitea.dooplex.hu/admin/felhom-hub:0.84.0` built on DooPlex and pushed
+(digest `sha256:1292cf28…`, 25 MB). `manifests/hub.yaml:128` bumped in git, ArgoCD hard-refreshed and
+**deliberately synced** (never `kubectl set image`).
+
+- ArgoCD app `felhom`: **Synced / Healthy**
+- `kubectl -n felhom-system get deploy hub` image: **`gitea.dooplex.hu/admin/felhom-hub:0.84.0`**
+- Rollout: `deployment "hub" successfully rolled out` (rc=0)
+- Startup log: `2026/07/31 08:21:13 [INFO] felhom-hub 0.84.0 starting`
+- *(The deployment object is named `hub`, not `felhom-hub` — the build script's printed hint names the
+  image, not the workload.)*
+
+**Method: endpoint-level** (browser automation is not available on DooPlex). Driven through the hub
+ClusterIP `10.43.52.34:8080` with a **real cookie-jar session** — `POST /login` with the operator
+password, CSRF token read out of the rendered host page, then the POST with `X-CSRF-Token`. That is
+the exact path the UI takes; no server logic is skipped, only rendering.
+
+| # | Check | Result |
+|---|---|---|
+| 0 | `POST /login` → session cookie | 303, `hub_session` set |
+| 0 | `GET /hosts/demo-felhom-8363b5` renders the card | `Console access` ×1, `data-reveal-url="/hosts/demo-felhom-8363b5/reveal-recovery-credential"` present |
+| 1 | `POST …/reveal-recovery-credential` (session + CSRF) | **HTTP 200**, `Cache-Control: no-store`, `Content-Type: application/json`, `username=root@pam`, `set_at=2026-07-18T16:30:41Z`, **password field present, 32 chars** |
+| 2 | **The one that matters** — is that password in the host page? | **ABSENT** from the captured page, from a freshly re-fetched page, AND from the customer page (the shared `host_detail_body` surface) |
+| 2b | Is it in the hub log? | **ABSENT.** The log carries `[INFO] operator revealed break-glass console credential for host demo-felhom-8363b5 (user=root@pam, secret 32 chars)` — username + length only |
+| 3 | Did the event land? | **Yes, exactly one** — the Hungarian line *„…konzolos hozzáférési jelszavát (távoli hibaelhárítás)."* on `demo-felhom`'s timeline |
+| 4 | Unknown host | **404** |
+| 4b | CSRF gate (session cookie, no token) | **403**, and the body carries no secret |
+| 4c | Method gate (`GET` on the reveal route) | **405**, and the body contains no `Console access` — it did **not** fall through to the catch-all |
+
+**The password was never printed** — it was written to a scratch file and used only as a `grep -F -f`
+pattern, so §15.4's secrets rule holds for this report and for the session transcript.
+
+**One live leg has no subject, and it is a gap worth naming.** Step 4 asked for a 404 against a host
+with **no** vaulted row. **All five enrolled hosts have one** (`demo-felhom-8363b5`,
+`demo-hp-bb76ea`, `drill-r50-0a4f9a`, `sess-f-2670b5`, `sess-g-e687c3` — each renders a Reveal
+control, none renders `not vaulted`), so the not-vaulted branch **could not be exercised live**; the
+404 above is the unknown-host path instead. That branch is covered by Test Group C (render + POST),
+not by a live observation, and this report does not claim otherwise.
 
 ## 7. NOT yet live-validated — awaiting the operator