From 6040c7b93d786143f8d68e10bf8d37820abb02d1 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 12 Jul 2026 19:20:39 +0200 Subject: [PATCH] drill report: customer-claim arc resolution + post-claim-arc snapshot + follow-up observations Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN --- documentation/audits/DRILL-day0-vm-2026-07-12.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/documentation/audits/DRILL-day0-vm-2026-07-12.md b/documentation/audits/DRILL-day0-vm-2026-07-12.md index 860e219..4a400ed 100644 --- a/documentation/audits/DRILL-day0-vm-2026-07-12.md +++ b/documentation/audits/DRILL-day0-vm-2026-07-12.md @@ -167,6 +167,20 @@ non-HU geo-block verification (needs a non-HU vantage). | `pre-day0-clean` | 15:12 | PVE 9.2.2 + keys, nothing Felhom — the universal re-drill zero | | `post-install` | 15:35 | Day-0 SUCCESS + ActualBudget + guests-dir chown | | `post-drill` | 17:11 | full drill end state (WG + PBS-DR + escrowed + geo HU + dashboard OPEN per F-4) | +| `post-claim-arc` | 19:08 | customer-claim arc: ctrl 0.122.0, demo-vm-felhom CLAIMED (customer-set password), gate proven | + +## 10. F-4/F-5 resolution — customer-claim arc (2026-07-12, same day) + +Shipped **hub v0.50.0 + controller v0.122.0** (both LIVE): the dashboard password is customer-owned, +set via a one-time claim code the hub emails to the registered address. An unclaimed box serves only +the claim page — F-4's open-dashboard exposure and F-5's unauthenticated geo toggle are both closed. +Live-proven on this drill box (gate ON via the real edge; Viktor claimed it, code generation consumed, +box now password-gated) and on the live demo after the floor raise (0.121→0.122 → claim-gated). Two +follow-up observations for the backlog: (a) the hub issues a claim code to EVERY reporting customer on +first report (peti + demo also emailed) — benign for pre-0.122 boxes (no gate, ACK ignored), but a +real customer on an old controller gets an unusable "beállító kód" email; consider gating issuance on +reported controller version ≥ 0.122. (b) the drill's reset flow (Scenario C) was deferred by the +operator — worth one supervised pass before Peti onboarding. Blast radius honored: guest demo 9201 on felhom-pve, Peti's hub entry, and the demo offbox were never touched. Drill leftovers to tidy at teardown (deliberately kept for re-drills now): hub