0.324.0 is the floor (02:46 UTC) after the night's off-site runs on all three test boxes; R-1105, R-1107 closed

documentation/backlog/CLOSED-ITEMS.md

@@ -30,6 +30,8 @@
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-1105** | **The controller runtime is still Debian 12, because Debian 13 moves the off-site engine from restic 0.14.0 to 0.18.0.** (P3) | CLOSED 2026-10-17 — the controller runs Debian 13 with restic pinned outside the OS (v0.323.0: 0.18.1; **v0.324.0: 0.19.1**, operator 2A). Every off-site assumption re-proven with REAL outputs of 0.14.0, 0.18.1, 0.19.1 (`TestR1105_*`); the one change (the forget plan keeps each group's oldest snapshot while monthly slots are unused) only keeps more. Both directions byte-identical on demo-hp's real store; prune proven on a scratch store. Night 2026-10-17: all three test boxes `backup OK` on 0.324.0 (02:15–02:18 UTC); **global floor 0.324.0 / MinAgent 0.158.1 at 02:46 UTC**, read back from the hub DB (with its WAL) and the hub's page; per-box floors cleared. One check left in STATUS: the old restic reads demo-hp's store after its first real 0.19.1 prune (window after 2026-10-18 14:16 UTC). `07` §6.8. | `audits/night-restore-2026-10-17/`, `audits/debian13-restic-2026-10-16/` |
+| **R-1107** | **The pinned restic 0.18.1 official release binary carries 50 fixable security findings (2 critical, 48 high): it is built with Go 1.25.1 (25 standard-library findings) and old modules (x/crypto v0.41.0, x/net v0.43.0, grpc v1.74.2, otel v1.36.0 — 25).** (P3) | CLOSED 2026-10-17 — operator decision 2A: **restic 0.19.1** in controller v0.324.0 (official binary, signed sums, both per-arch sums pinned; a wrong sum fails the build — proved). Its notes read: one change (a missing top-level path exits 3) — reaches only a race, now loud. Scanner: restic's part 50 fixable → 19; image critical 3 (2) → 1 (0), high 122 (52) → 93 (23). On every box with the global floor 0.324.0 (02:46 UTC). | `audits/night-restore-2026-10-17/`, `audits/debian13-restic-2026-10-16/` |
 | **R-1065** | **After the Plex claim the box does not set Plex's libraries until the next wiring run.** (P3) | CLOSED 2026-10-17 — **controller v0.324.0**: a successful Plex claim schedules the media wiring (`RunMediaWiringSoon`, both claim routes). `TestPlexClaim_TriggersMediaWiring` (claimed / refused / never claimed), red-proved. Not seen live: no claim code tonight; the N100's next claim is the live observation. | `audits/night-restore-2026-10-17/` |
 | **R-926** | **After a household removes an `after_install` app keeping its backups and then restores it, nobody has checked whether the app page still shows a password that works.** (P3) | CLOSED 2026-10-17 — answered from the code and fixed where it was wrong. After a unit restore that had to GENERATE a `type: password` login, the page never shows it and says to use the old password (R-694's `RestoredLogins`) — the household's own password works (measured for grocy 2026-10-10). The path that was wrong: an off-site restore over a reinstall kept the reinstall's admin login as „the login”; since **controller v0.324.0** `SetStackSecretValues` records those as restored-login fields too (`TestR1106_SetStackSecretValues`, red-proved). | `audits/night-restore-2026-10-17/` |
 | **R-1106** | **An app with a database that is removed, reinstalled and then fully restored from the off-site copy comes back unusable: the restore puts back the OLD database volume, which carries the old install's database password, while the reinstall generated a new one.** (P2) | CLOSED 2026-10-17 — **controller v0.324.0** (operator decision 1A): the database password comes back with the data. The off-site full restore over a reinstall writes the snapshot's password before the database starts (only when the snapshot replays the DB volume); the shared unit-restore env refuses, before any change, when neither the unit nor an install OLDER than the data holds it; O4 never generates a DB password. **Live on demo-hp 9201** (rc.1, the dashboard's posts): Rallly (Postgres) and Grimmory (MariaDB) seeded, removed, reinstalled, restored — off-site path: marker row + books file back, both apps healthy, the app's and the dump user's DB logins work (last night: crash loop and held); on-box path (Rallly) the same; the refusal (Rallly unit without its password) refused with the app untouched; „use my kept data” (Grimmory) the same. Tests `TestR1106_*` red-proved; catalog gate `db-credentials`. `07` §7.4. | `audits/night-restore-2026-10-17/` |

documentation/backlog/OPEN-ITEMS.md

@@ -237,12 +237,10 @@ stopping line that lies.
 | **R-1050** | Security & access | P4 | **Raise HSTS to one year on or after 2026-11-15, if no https trouble was reported.** `09` §3 decision 249 (D2 = A, operator 2026-10-15): HSTS stays `max-age=86400` now; after a month with no https trouble it becomes one year (`31536000`); never preload, never `includeSubDomains`. The value is `HSTSMaxAgeSeconds` in `felhom-controller/controller/internal/infra/infra.go`, pinned by `TestRenderForwardedHeaders_HTTPSOnly`. „Trouble” = any report of a name that will not open, or a box answering http after the floor. | **WATCHING** — filed 2026-10-15 | the date | On or after 2026-11-15: read the register and the operator's mail for https trouble since 2026-10-15; none → a controller release with one year (test updated), bake → vouch → floor | CC |
 | **R-1054** | Security & access | P3 | **The hub's operator/global API key is still one bearer that can do everything on `/api/v1`, including reading every box's break-glass root password (`GET /admin/hosts/{id}/recovery-credential`).** Hub v0.152.0 gave the web surface scoped tokens (`05` §17) but tokens are refused on `/api/v1` by design. Who uses the global key today is not listed in one place. Fix: list its consumers; move each operator use to a scoped token on the web side (or a token class on the API), and keep the global key only where a box path needs it — or retire it. | OPEN — filed 2026-10-15 by the token build | — | List the global key's consumers (pod env, scripts, runbooks) | CC |
 
-## Box system & updates — 14 rows (P2 1, P3 9, P4 4)
+## Box system & updates — 12 rows (P2 1, P3 7, P4 4)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
-| **R-1105** | Box system & updates | P3 | **The controller runtime is still Debian 12, because Debian 13 moves the off-site engine from restic 0.14.0 to 0.18.0.** The off-site code's measured behaviour is restic 0.14.0's: a missing source path is only a warning (`offbox_capture.go`), the `--json` progress shape (`offbox_progress.go`), the forget day-buckets (`offbox_window.go`), restore without a lock (`offbox_proof.go`). Debian 12's restic binary is built with go1.19.8. Measured 2026-10-16 on demo-hp: one off-site backup with 0.18.0 (backup OK, 172 snapshots), then 0.14.0 on the same store (backup OK, 186) — so the store stays readable both ways; the rest is NOT measured. | **NARROWED** 2026-10-16 (evening): **re-proven and released to the three test boxes** — controller v0.323.0: Debian 13.7, restic 0.18.1 pinned outside the OS (official binary, signature + two sums checked at build). Every assumption re-proven with REAL outputs of both versions (`testdata/restic/`, `TestR1105_*`); the one that moved is the forget plan (0.17+ keeps the oldest snapshot while monthly slots are unused — only ever more kept). Both restore directions byte-identical on demo-hp's real store; the drill's row and file came back. Tester 1, demo-hp, demo-felhom on 0.323.0 at 19:25 UTC by per-box floors, box walk green. `07` §6.8. Evidence `audits/debian13-restic-2026-10-16/` | each test box's first real night on 0.323.0 (≈02:15 UTC 2026-10-17); demo-hp's next clean-up window (after 2026-10-18 14:16 UTC) | Read each box's `offbox.last_success` after 2026-10-17T00:00Z with `last_status` ok (the command is in `STATUS.md`); then the global floor 0.323.0 / MinAgent 0.158.1 and clear the three per-box floors; close when 0.14.0 (image 0.322.0) still lists and restores demo-hp's store after the first 0.18.1 prune there (`tools/rx.sh`) | CC |
-| **R-1107** | Box system & updates | P3 | **The pinned restic 0.18.1 official release binary carries 50 fixable security findings (2 critical, 48 high): it is built with Go 1.25.1 (25 standard-library findings) and old modules (x/crypto v0.41.0, x/net v0.43.0, grpc v1.74.2, otel v1.36.0 — 25).** Measured 2026-10-16, trivy 0.74.0 on controller 0.323.0-rc.1: they are most of the image's fixable highs (52 of 122). Debian 12's restic 0.14.0 was not flagged by the scanner (a Debian package, judged by Debian's tracker). Options measured the same day: restic **0.19.1** official (Go 1.26.4) — 0 critical / 19 high; 0.18.1 built from its signed source on our Go 1.27.2 — about 25 (the module half stays). The re-proof is now cheap: capture the new version's outputs into `testdata/restic/<version>/` (`audits/debian13-restic-2026-10-16/tools/fixtures.sh`) and run `TestR1105_*`. | WAITING-ON-OPERATOR — filed 2026-10-16 | the operator: stay on 0.18.1 (the brief's choice), or move to 0.19.x (a second version step, with the same re-proof) | On the operator's word: pin 0.19.x, capture its fixtures, re-run the R-1105 suite and the demo-hp drill | CC |
 | **R-984** | Box system & updates | P4 | **Host and agent hardening, low risk each: the backup-target route has no role check; the unsigned guest spec has no size bounds; signed ops have no maximum validity; the guarded mkfs does not refuse LVs, zvols or RAID devices; the local API is reachable from the LAN by a static route; a sudoers inspect pattern is wider than needed; install passes secrets on the command line; guest settings files are world-readable; the host offers rpcbind and DNS on the LAN.** Fix each in its own small change. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Batch into hardening work | CC |
 | **R-982** | Box system & updates | P3 | **The Proxmox host accepts root password login over SSH from the LAN (measured on demo-hp), so anyone on the household network can try the root password.** Design-shaped: the break-glass password exists for the console. Fix: key-only SSH for root; the password stays for the console. Evidence: `audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt`. | OPEN — design-proposal | — | Decide; then set it in the installer and the config bundle | CC |
 | **R-979** | Box system & updates | P3 | **Controller updates are trusted by registry tag alone (no digest, no signature), and the Update button offers any newer tag, even an unvouched one; the built-in traefik, cloudflared and FileBrowser images are also pinned by tag only.** Whoever can push to the registry decides what runs. Fix: pin by digest from the hub's vouched list; offer only vouched versions. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN — design-proposal | — | Design note, then build | CC |