From 4951fc22836835b90b951cd1cbe21c797fc85ead Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 30 Sep 2026 09:49:41 +0200 Subject: [PATCH] Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CONTEXT.md | 6 ++++++ .../architecture/01-topology-and-trust.md | 4 ++++ .../architecture/07-backup-architecture.md | 7 +++++++ .../architecture/09-update-architecture.md | 13 +++++++++++++ .../part0/checklist.md | 17 +++++++++++++++++ .../part0/cloudflare-dns.txt | 8 ++++++++ .../part0/dns.txt | 16 ++++++++++++++++ .../part0/ep0-storagebox.txt | 16 ++++++++++++++++ 8 files changed, 87 insertions(+) create mode 100644 documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/checklist.md create mode 100644 documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt create mode 100644 documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/dns.txt create mode 100644 documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/ep0-storagebox.txt diff --git a/CONTEXT.md b/CONTEXT.md index 34cab30a..ac2abdc8 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -16,6 +16,12 @@ > and holds nothing of its own; this file does hold its own content, namely the standing rulings below. +> **2026-09-30 — operator rulings 50 (apps go off-site by themselves, A) and 51 (ep0 drill archives removed; the +> restore test takes only the box's own).** `09` §3. 50: when the customer has off-site, every newly installed app is +> in the off-site copy; over quota the page names the largest and the household chooses; history is never deleted to +> make room without that choice. 51: the three drill archives in `tester-1`'s ep0 namespace go, nothing else. Also: the +> first real tester is a NEW record `Tester-2`; the volunteer guide is rewritten as measured (R-722). + > **2026-09-29 evening — operator rulings 48 (wanderer stays, A) and 49 ("close sign-up now", A).** Controller > **v0.282.0**: `after_setup:` (the app's own sign-up switch, env merged + one `compose up -d`, when the gate opens or on > the press; the window lifts it, the loop restores it), `POST /apps//close-signup` (lock record `opened_by: diff --git a/documentation/architecture/01-topology-and-trust.md b/documentation/architecture/01-topology-and-trust.md index 3c7ebcab..7ea35309 100644 --- a/documentation/architecture/01-topology-and-trust.md +++ b/documentation/architecture/01-topology-and-trust.md @@ -191,6 +191,10 @@ the same way. ## 8. Storage & backup +> **2026-09-30 (operator, `09` §3 decisions 50–51):** a new box's apps are in the off-site copy by default (07 §6); +> the whole-guest restore test takes only the box's OWN archives — an earlier box's archive left in the customer's +> ep0 namespace is never this box's proof, and the three drill archives found there are removed. + **Tiers** (escalating failure scope): | Layer | Mechanism | Survives | Note | diff --git a/documentation/architecture/07-backup-architecture.md b/documentation/architecture/07-backup-architecture.md index 048addde..b2fc4f03 100644 --- a/documentation/architecture/07-backup-architecture.md +++ b/documentation/architecture/07-backup-architecture.md @@ -297,6 +297,13 @@ fresh box the same day: five photos put into Nextcloud, deleted, restored from t and none of them opened (`audits/DRILL-prove-fixes-0243-2026-09-16.md`, R-537/R-538). Implemented in hub v0.116.0 (`handleConfigNewForm`). **What this ruling does NOT change: what any tier captures.** +**[RULING 2026-09-30, operator — `09` §3 decision 50] …and every app on such a box is IN the off-site copy by +default.** The 2026-09-16 ruling turned the tier on per customer; a per-app switch that started OFF left a new +household's apps out of it (measured on a fresh box, `audits/DRILL-new-household-2026-09-30.md`, R-720). A newly +installed app on a box whose customer has off-site is switched on at install. Over the customer's quota the page names +the largest apps and the household chooses; **the box never deletes off-site history to make room without that +choice.** Apps installed before the release are offered one press, never switched by the release itself. + **The app update's safety precondition accepts ANY tier** (operator ruling 2026-09-13, controller v0.239.0, R-475): the first fresh copy in the order Tier 2, Tier 1, Tier 3; with none, it backs up diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md index c17e657e..20641492 100644 --- a/documentation/architecture/09-update-architecture.md +++ b/documentation/architecture/09-update-architecture.md @@ -548,6 +548,19 @@ R-636's louder repeated alarm. is case-insensitive (termix's router ignores case). Final trick run: 113 tries on 11 apps, 0 got in. Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them in the operator's credentials file (not in any repo). +50. **Every newly installed app goes off-site by itself when the customer has off-site** — *operator ruling 2026-09-30 + (R-720, option A).* It restores the intent of the 2026-09-16 ruling (`07` §6: Tier 3 ON for every new customer), + which a per-app switch starting OFF had undone. If the apps will not fit the customer's quota, the page says so, + names the largest, and the household chooses which stay off-site. Apps already installed are not switched by a + release (the 2026-09-29 Part 0 rule); the backups page offers one press to switch them all on. + **The box never deletes off-site history to make room without the household's choice.** *(Outcome: filled in by + the 2026-09-30 fixes session.)* +51. **ep0: the three whole-guest archives of deleted drill boxes in `tester-1`'s namespace are removed, and only + those** — *operator ruling 2026-09-30 (R-727).* With before/after controls on every other namespace. The restore + test is fixed to take only the current box's own archives, so an archive of an earlier box in the same namespace + can never be tested again. *(Outcome: filled in by the 2026-09-30 fixes session.)* + Same day, operator: the first real tester gets a NEW customer record (`Tester-2`, domain `sajatfelhom.hu`), not + `tester-1`; and CC rewrites the volunteer guide as measured (R-722). --- diff --git a/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/checklist.md b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/checklist.md new file mode 100644 index 00000000..64a6dce0 --- /dev/null +++ b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/checklist.md @@ -0,0 +1,17 @@ +# Tester-2 — read-only readiness check, 2026-09-30 07:47 UTC + +Nothing on Tester-2, Cloudflare, ep0 or the Storage Box was changed. Sources: the hub's customer page, the hub log, +public DNS (`dns.txt`), Cloudflare GET calls with the API token stored on the record (`cloudflare-dns.txt`), ep0 +listing (`ep0-storagebox.txt`). + +| # | item | state | where to fix | +|---|---|---|---| +| 1 | Tunnel token pasted | **done** — names tunnel `3ce0eccd-…-43c093aa8822` (Peti's original tunnel, reused) | — | +| 2 | DNS of `sajatfelhom.hu` | **done** — exactly ONE record: `*.sajatfelhom.hu` CNAME → that same tunnel, proxied (created 2026-02-27). No leftover pointing elsewhere. Today every name answers **530** = no connector, which is right with no box | — | +| 3 | The tunnel's published route (`*.sajatfelhom.hu` → `https://traefik`, **No TLS Verify** ticked) | **UNKNOWN** — the API token on the record may read DNS only; the tunnel read answered `Authentication error` (stopped there) | Cloudflare → Zero Trust → Networks → Tunnels → this tunnel → Published application routes. Without the route the dashboard answers 503; without No TLS Verify, 502 (R-505, R-510) | +| 4 | Off-site | **done** — ON, shared, 100 GB; new sub-account id 322460 (username `u629488-sub2` reused; Peti's sub-account 269130 was emptied and deleted 2026-09-25) | — | +| 5 | DR tier (ep0) | **done** — ON; ep0 holds nothing for Tester-2 yet (made when the box connects) and nothing of Peti's | — | +| 6 | The connect e-mail | **sent 07:36 UTC — TWICE** (the customer was created twice in the same second; two different links). Both valid until **2026-10-07 07:36 UTC** | If your friend installs after that: hub → Tester-2 → „Send self-bind link" (Part D makes this automatic) | +| 7 | E-mail language | **English** — the connect mail, the bind page, the setup-code mail and the box itself start in English | Hub → Tester-2 → Edit → „Customer e-mail language", if your friend should get Hungarian | +| 8 | Owner passphrase | yours to hand over (5 words, on the customer page) | in person or by phone | +| 9 | Customer id `Tester-2` has a capital letter | **never walked before** with a capital; no known break | — (note only) | diff --git a/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt new file mode 100644 index 00000000..5d147432 --- /dev/null +++ b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt @@ -0,0 +1,8 @@ +## 2026-09-30T07:47:44Z Cloudflare DNS records of sajatfelhom.hu (GET only, with the API token stored on Tester-2's record) +Tester-2's tunnel token names tunnel id: 3ce0eccd-03f0-424a-90b9-43c093aa8822 +success True count 1 [] + CNAME *.sajatfelhom.hu 3ce0eccd-03f0-424a-90b9-43c093aa8822.cfargotunnel.com proxied=True created 2026-02-27 <- THIS customer tunnel +## tunnel 3ce0eccd-03f0-424a-90b9-43c093aa8822 (GET only) +tunnel: False ['Authentication error'] name None status None deleted_at None connections 0 config_src None +config: False ['Authentication error'] + top originRequest None diff --git a/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/dns.txt b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/dns.txt new file mode 100644 index 00000000..2ef72422 --- /dev/null +++ b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/dns.txt @@ -0,0 +1,16 @@ +## 2026-09-30T07:47:11Z public DNS for sajatfelhom.hu (@1.1.1.1), read only +NS: martha.ns.cloudflare.com. tony.ns.cloudflare.com. +sajatfelhom.hu A: CNAME: +felhom.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +www.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +wiki.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +paste.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +photos.sajatfelhom.hu A: 104.21.90.232 172.67.162.57 CNAME: +nextcloud.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +files.sajatfelhom.hu A: 104.21.90.232 172.67.162.57 CNAME: +jellyfin.sajatfelhom.hu A: 172.67.162.57 104.21.90.232 CNAME: +zzqx-nonexistent.sajatfelhom.hu A: 104.21.90.232 172.67.162.57 CNAME: +GET https://felhom.sajatfelhom.hu/ → 530 +GET https://wiki.sajatfelhom.hu/ → 530 +GET https://zzqx-nonexistent.sajatfelhom.hu/ → 530 +edge cert: X509v3 Subject Alternative Name: DNS:*.sajatfelhom.hu, DNS:sajatfelhom.hu diff --git a/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/ep0-storagebox.txt b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/ep0-storagebox.txt new file mode 100644 index 00000000..3534cc89 --- /dev/null +++ b/documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/ep0-storagebox.txt @@ -0,0 +1,16 @@ +## 2026-09-30T07:48:15Z ep0 namespaces (read-only) +demo-felhom +demo-hp +tester-1 +/mnt/pbs-datastore/ns/demo-felhom/: +ct + +/mnt/pbs-datastore/ns/demo-hp/: +ct + +/mnt/pbs-datastore/ns/tester-1/: +ct +felhom@pbs!demo-felhom +felhom@pbs!demo-hp +felhom@pbs!tester-1 +## Storage Box sub-accounts (GET only)