09 §3 decisions 185-194: the operator's decision sheet D1-D10 recorded first; rulings in each row; R-717 closed (D5)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-08 14:25:15 +02:00
parent 4ef2fee090
commit 4510dd7d05
3 changed files with 46 additions and 11 deletions
@@ -26,6 +26,14 @@

 ---

+## 2026-10-08 (evening) — the operator's decision sheet D1–D10
+
+The full text of every row below: `git show 4ef2fee090:documentation/backlog/OPEN-ITEMS.md`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-717** | **opengist kept its sign-up switch only in its own database; the box closes it with the address block alone.** (P3) | CLOSED 2026-10-08 — DECIDED: the measured address block is enough for opengist (operator ruling D5, `09` §3 decision 189, design option C). Wishlist's half was done 2026-10-06 (controller v0.301.0 `open_command`, proven on 9202) | Block `signup_block: "PathRegexp(`(?i)^/+-/+register`)"` (catalog `templates/opengist/.felhom.yml`); every trick shape — trailing slash, upper/mixed case, percent-encoded, double slash, query string — answered 403 (`audits/signup-lock-2026-09-29/B/B6-tricks-all-regex.txt`); the app publishes no port, traefik is its only door. Design `audits/day-2026-10-08/design-R-717.md` (option A stays written there if the operator ever wants the app's own switch closed too). |
+
 ## 2026-10-08 (afternoon) — the morning's answers built

 The full text of every row below: `git show b2dce901b2:documentation/backlog/OPEN-ITEMS.md`.