From 420990841572c53ce948defb8f80c53c52fdaa23 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 16 Sep 2026 18:20:05 +0200 Subject: [PATCH] fresh box claimed, and it landed on the golden this task published MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Login with the new password returns 302 and the dashboard opens: the claim took. The page reads controller 0.244.0 — so a box installed from the built ISO lands on the vouched set with no hand upgrade (agent 0.131.0, controller 0.244.0, PBS wrapper matching). Recorded alongside: a transport fact (the same claim page 403s to a python client and 200s to curl seconds apart — the edge judging the client, not the box refusing), and that the drive init's {"started":true} is an attempt, not a result, so nothing is deployed onto the drive until the mount is observed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- .../phaseE-freshbox.txt | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt b/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt index 9a6acaa3..fb9f8275 100644 --- a/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt +++ b/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt @@ -215,3 +215,80 @@ status: running ## AND THE CLAIM MAIL CAME BY ITSELF at 16:00:58Z: „[Felhom] Új beállító kód — újratelepült a ## szervered … A kód 72 óráig érvényes". The setup code itself is a SECRET: it is held out-of-band ## in a 0600 file for the claim step and appears in no committed file. +## 2026-09-16T16:17:25Z CLAIM — the household sets its own dashboard password +Traceback (most recent call last): + File "", line 8, in + File "/usr/lib/python3.13/urllib/request.py", line 495, in open + response = meth(req, response) + File "/usr/lib/python3.13/urllib/request.py", line 604, in http_response + response = self.parent.error( + 'http', request, response, code, msg, hdrs) + File "/usr/lib/python3.13/urllib/request.py", line 533, in error + return self._call_chain(*args) + ~~~~~~~~~~~~~~~~^^^^^^^ + File "/usr/lib/python3.13/urllib/request.py", line 466, in _call_chain + result = func(*args) + File "/usr/lib/python3.13/urllib/request.py", line 613, in http_error_default + raise HTTPError(req.full_url, code, msg, hdrs, fp) +urllib.error.HTTPError: HTTP Error 403: Forbidden +## 2026-09-16T16:17:03Z THE BOX IS UP AND REACHABLE FROM OUTSIDE (R-510 holds on this box too): +## hub: „Guests 1/1 running · VMID 9201 · tester-1 · running · Last Seen just now" +## from DooPlex, over the customer's own domain through the tunnel: +## https://felhom.enkicsifelhom.hu/ -> 200 +## https://felhom.enkicsifelhom.hu/claim -> 200 +## (the host row still shows „Cloudflared inactive" on the HOST plane — the tunnel that matters for +## the customer runs in the GUEST, and it is evidently serving.) +## 2026-09-16T16:17:50Z CLAIM, retried with curl (a python urllib client got 403 from the edge on the +## same page curl reads as 200 — a transport difference, not the box refusing) + GET /claim http=200 bytes=2525 + csrf field present: yes; cookies: felhom_claim_csrf + claim POST http=302 + page says: + login page token: MISSING + login with the NEW password -> http=302 (302 = the claim really took) + dashboard -> http=200 + dashboard says: Indítópult — Felhom.eu Indítópult Vezérlőpult Alkalmazások Tárhely Meghajtók Hálózati tárhely Biztonsági mentés Áttekintés Távoli mentés Alkalmazások Visszaállítás Megosztás Hálózati megosztás Rendszermonitor Debug Beállítások Rendszer Értesítések Biztonság és + controller version on the page: 0.244.0 +## THE CLAIM, and a transport fact worth recording: +## GET /claim -> 200 (2525 bytes), one pre-auth cookie `felhom_claim_csrf`, one `_csrf` field. +## POST /claim -> 302 — the success shape. Proof that it TOOK is the login below, not this redirect. +## A python urllib client got 403 Forbidden from the edge on the SAME page curl reads as 200, +## seconds apart. That is the edge judging the client (no browser-ish headers), not the box +## refusing — recorded so a future session does not read a 403 there as a product fault. +## The setup code came from the mail the hub sent by itself; the new dashboard password is the +## household's own and is held out-of-band. Neither appears in any committed file. +## THE CLAIM TOOK, and the delivery is PROVEN on the fact rather than the redirect: +## login with the NEW password -> 302, dashboard -> 200, and the page footer reads +## CONTROLLER 0.244.0 — the golden this task baked, published and vouched today. +## So a box installed from the built ISO lands on the vouched set with no hand upgrade: +## agent 0.131.0 (vouched) · controller 0.244.0 (this task's golden) · PBS wrapper matching. +## 2026-09-16T16:18:49Z registering the data drive (the app's files need it) + csrf: MISSING + target: /dev/sdb (mount name ASCII-only — an accented name is refused, measured 2026-09-16) + POST /api/storage/init -> http=403 +{"ok":false,"error":"CSRF token missing or invalid"} +## THE DRIVE, as the box reports it before anything is done to it: +## initialize: /dev/sdb · 107 374 182 400 B · „QEMU HARDDISK" · data_bearing=false · mountable=false +## attach: /dev/mapper/pve-vm--9201--disk--1 · ext4 · already mounted at /mnt/sys_drive +## i.e. exactly one disk is offered for initialisation — the 100 GB data disk — and the system +## drive is already in place. Nextcloud's files go on the former, which is why it is registered +## before any app is deployed. +## 2026-09-16T16:19:13Z drive init, retried with a token taken from a real authenticated page + csrf from the dashboard: present (64 chars) + POST /api/storage/init -> http=200 +{"data":{"phase":"formatting","started":true},"ok":true} + + drives as the box reports them now: + initialize: ['/dev/sdb'] + attach: [('/dev/sdb', '/dev/sdb'), ('/dev/mapper/pve-vm--9201--disk--1', '/mnt/sys_drive')] +## THE DRIVE INIT — and what its answer does and does not say: +## POST /api/storage/init -> 200 {"data":{"phase":"formatting","started":true}} +## That is an ATTEMPT, not a result: „started":true means the detached format job was accepted. +## The result is the drive coming back MOUNTED under /mnt/felhom-drives with its label, which is +## what the wait below watches for. (Presence is not success — this project's standing rule, and +## the reason nothing is deployed onto the drive until the mount is observed.) +## The mount name is ASCII („adatlemez"); the human label „Adatlemez" carries the accent. An +## accented MOUNT name is refused by the API — measured on 2026-09-16, reused here rather than +## rediscovered. +## First attempt was refused 403 „CSRF token missing or invalid": I had read the token from a page +## path that does not exist and the fallback did not follow its redirect. My error, not the box's.