From 8b0a4413cd640fe666943ab7f60cabad588b1963 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 16 Oct 2026 10:02:01 +0200 Subject: [PATCH] R-1088 and R-1086 closed (token rotated; D11 applied); R-1091 (1)(2) done (D12); STATUS decisions answered Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- REPORT-app-guides-2026-10-15.md | 12 ++++++++++++ STATUS.md | 3 --- documentation/backlog/CLOSED-ITEMS.md | 9 +++++++++ documentation/backlog/OPEN-ITEMS.md | 8 +++----- 4 files changed, 24 insertions(+), 8 deletions(-) diff --git a/REPORT-app-guides-2026-10-15.md b/REPORT-app-guides-2026-10-15.md index ec5ce5a3..c777d3c6 100644 --- a/REPORT-app-guides-2026-10-15.md +++ b/REPORT-app-guides-2026-10-15.md @@ -22,3 +22,15 @@ The full report is `app-catalog-felhom.eu/REPORT.md`. This file is the felhom.eu - Read only: nothing installed, removed, restarted or set; logged out after. Teardown: provisioned nothing. - **R-1088 updated, not closed:** restore and check done; the hub token rotation is still the operator's. - STATUS: the „read the guides" line now says the robot check passed; the R-1088 line now asks for the rotation only. + +## 2026-10-16 — the operator's answers applied + +- **Token rotated (operator).** CC checked the token in the credentials file works on the hub: `/hosts` and + `/configuration` 200 with it, 302 without it. **R-1088 CLOSED.** +- **D11 → stop advising the change.** Catalog `5cc9e0e`: qBittorrent's first step now says keep the generated password; + qBittorrent and Transmission field descriptions no longer say „change it later". **R-1086 CLOSED.** +- **D12 → reword.** Catalog `5cc9e0e`: Cal.com names Apple Calendar or CalDAV, not Google/Outlook; BentoPDF says the + browser does the work and the file stays on the device. **R-1091 stays open** for its other items; (1) and (2) are + marked done. +- Register: 178 → 176 rows; 0 opened, 2 closed (moved to `CLOSED-ITEMS.md`). STATUS: D11, D12 and the token line removed. +- Gates: catalog `--fast` and 12 test files green; felhom.eu `repo_gates.py --fast` green before the push. diff --git a/STATUS.md b/STATUS.md index 4ffd6061..3d029e28 100644 --- a/STATUS.md +++ b/STATUS.md @@ -47,12 +47,9 @@ | D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — | | D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — | | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — | -| D11 | R-1086 | qBittorrent's first steps say „set your own password”, but then the box can no longer link it to Sonarr and Radarr. Stop advising the change, or let the box ask for the new password? | **Stop advising it** — the generated password is long and shown on the dashboard | The box asks: a new card and controller work | a household that follows the advice loses its automatic downloads without being told | — | -| D12 | R-1091 (1), (2) | Cal.com promises Google/Outlook calendar sync that is not set up, and BentoPDF says files are processed „on the server” (they are processed in the browser). Reword both to what is true? | **Yes, reword** | Keep: two promises that are not true | the app pages keep saying it | — | ## Waiting on you — do - **Olvasd el a Plex és a Sonarr útmutatót a demo-hp-n** (az alkalmazás oldalán az „Útmutató” fül). Ha más formát szeretnél, egy menetben átírom mind a 62-t. A robot 2026-10-16-án bejelentkezve megnézte: mindkét oldal megjelenik magyarul és angolul, 4 rész és a GYIK, minden sor egyezik a katalógussal. Ha nem nézed meg: csak a forma marad emberi szemmel nem látott. -- **Rotate CC's hub token (R-1088).** The credentials file is restored (2026-10-16), and logins work again. The token was printed once into a transcript on 2026-10-15. If not: that printed token stays valid. - **Vouch agent 0.157.0 and its config bundle** (hub → Configuration → Artifacts). Then CC raises the global floor to controller 0.317.0 with MinAgent 0.157.0 and clears the three per-box floors. If not: households stay on 0.314.0 and keep counting a same-disk copy as a second copy; the three test boxes keep their own floor. - **Nézd meg az AdventureLog és a Plex oldalát a demo-hp-n, a rendes címén** (`felhom.enkisfelhom.hu`). A túl nagy keret javítva: a tartalom most 32 képpontra van a bal oszloptól és 36-ra a tetejétől (előtte 80 és 64 volt). Az alkalmazás oldala mostantól egy hasábban van: egy szélesség, vékony vonalak a szakaszok között, aláhúzott fül, és doboz csak ott, ahol az alkalmazás vár rád (kék) vagy ahol valami kockázatos (sárga). A „sikeres frissítés" sáv kis szürke sorrá vált a név alatt. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben. - **Nézd meg az új alkalmazás oldalt a demo-hp-n (egy telepített és egy nem telepített app).** Egy alkalmazás mostantól egy oldal négy füllel (Beállítások · Adatok és mentés · Útmutató · Napló), az Indítás/Újraindítás/Leállítás a „Működés" kártyán van, és a „Vissza" az alkalmazáshoz visz, nem a listához. Mondd meg, jó-e így az elrendezés. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben — a robot a DooPlexen nem tud kattintani. diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md index 92b9f01d..637d88bb 100644 --- a/documentation/backlog/CLOSED-ITEMS.md +++ b/documentation/backlog/CLOSED-ITEMS.md @@ -26,6 +26,15 @@ --- +## 2026-10-16 — the app-guides night, closed out (catalog `5cc9e0e`, felhom.eu scripts guard) + +| Row | What | Closed | Evidence | +|---|---|---|---| +| **R-1088** | **CC's credentials file was overwritten with one token, and that token was printed once into a session transcript.** (P2) | CLOSED 2026-10-16 — the operator restored `~/.config/credentials` from backup (17 keys; CC read the key names only) and rotated CC's hub token. CC verified the token in the file works: `/hosts` and `/configuration` 200 with it, 302 to login without it (a different channel from the file: the hub). The guard (felhom.eu, 2026-10-15 night): `read_credential.py` refuses an OUTFILE that is the credentials file by path, symlink or hard link, pinned by `test_the_outfile_can_never_be_the_credentials_file`, red-proved. The owed demo-hp rendering check of the Plex and Sonarr guides ran 2026-10-16 07:20 UTC and passed. **Reasoning kept:** the second argument of `read_credential.py` is the OUTPUT file — a reader that can write over its own source is a destroyer one typo away. | full text: `git show f51dfe20:documentation/backlog/OPEN-ITEMS.md`; `audits/app-guides-2026-10-15/credential-guard-redproof.txt`, `render-check-2026-10-16.txt` | +| **R-1086** | **qBittorrent's first steps told the household to set their own password — and the box's media wiring logs in with the INSTALL password, so after that change Sonarr and Radarr stop getting their downloads handed over and a safe drive removal cannot pause its torrents.** (P2) | CLOSED 2026-10-16 — operator decision D11: **stop advising the change** (option (a); the box asking for the changed password was not chosen). Catalog `5cc9e0e`: qBittorrent first step 2 now says to keep the generated password because the box links the downloader with Sonarr and Radarr with it; the qBittorrent and Transmission password-field descriptions no longer say „change it in the app afterwards”. Both re-admitted to the copy freeze. Not reproduced live (the fix removes the advice, not the mechanism). **Reasoning kept:** a household that changes it anyway still loses the hand-over without being told — accepted by the decision; the generated password is long, random and shown on the dashboard. The controller reads no other app's install password (grep over `controller/internal`, 2026-10-16), so the other apps' „change it later” lines stay. | full text: `git show f51dfe20:documentation/backlog/OPEN-ITEMS.md`; catalog CHANGELOG 2026-10-16 | + +--- + ## 2026-10-15 (night) — storage identity build A (agent v0.157.0, controller v0.317.0, hub v0.154.0) | Row | What | Closed | Evidence | diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md index 04f09601..1ec33b1a 100644 --- a/documentation/backlog/OPEN-ITEMS.md +++ b/documentation/backlog/OPEN-ITEMS.md @@ -124,14 +124,13 @@ stopping line that lies. | **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC | | **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator | -## Apps & catalog — 21 rows (P2 3, P3 11, P4 7) +## Apps & catalog — 20 rows (P2 2, P3 11, P4 7) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| -| **R-1086** | Apps & catalog | P2 | **qBittorrent's first steps tell the household to set their own password — and the box's media wiring logs in with the INSTALL password, so after that change Sonarr and Radarr stop getting their downloads handed over and a safe drive removal cannot pause its torrents.** FOUND 2026-10-15 night writing the qBittorrent guide; static, not yet reproduced. `templates/qbittorrent/.felhom.yml` first_steps[1] (set your own password on the Web UI settings page); felhom-controller `internal/mediawire/mediawire.go:124` (the wiring), `:437` (the Sonarr/Radarr client entry), `:757` and `:828` (pause/resume on safe removal) all read `QBT_ADMIN_PASSWORD` from the container env, and the template seeds no login bypass for the Docker network. Transmission has the same shape (`trPW`). Second fault in the same sentence: the qBittorrent Web UI starts in ENGLISH (the image sets no language — its env holds only PATH, read 2026-10-15), so the labels are „Options” and „WebUI”, not the Hungarian words the step quotes. The guide written tonight says nothing about the password. | OPEN — filed 2026-10-15 | Operator: (a) the copy stops advising a password change — the generated one is long, random and shown on the dashboard; or (b) the box asks for the changed password (an after-start field) | Reproduce on 9202 (change it, press „Bekötés most”, read Sonarr's client test), then (a) or (b) | CC | | **R-1089** | Apps & catalog | P2 | **RomM may never find the household's games: the first steps put them where the scan probably does not look.** FOUND 2026-10-15 night writing the RomM guide, from RomM 5.3.1's source — NOT measured. RomM's default layout is `library/roms//`; the compose mounts the drive's `userdata/roms` as `/romm/library`, so the first steps' `roms/gba/`, `roms/snes/` land at `library/gba`, outside the scan's `library/roms`. The same first steps send the household to a „Settings" menu and a left-hand „Scan" the new default UI (5.3.1) no longer has (both are in the profile menu now), and the compose comment's default login `admin / admin` is stale (the first run asks for a password). The guide written tonight gives no folder path. Draft and source note: `audits/app-guides-2026-10-15/B/romm-labels.txt`. | OPEN — filed 2026-10-15 | — | On 9202: install RomM, put one legal ROM where the first steps say, scan, read the library; then fix the path (copy or compose) and the two labels | CC | | **R-1090** | Apps & catalog | P3 | **Ghost may lock a household out of its own blog on a second device: new-device sign-in asks for a code by e-mail, and the box wires no e-mail for Ghost.** FOUND 2026-10-15 night from Ghost 6.67.0's source (`ghost/core` defaults: `security.staffDeviceVerification: true`) — NOT measured. The same missing mail makes staff invitations and newsletters impossible; the guide leaves those out and says so. Related: the first-admin audit already marks Rallly and Outline sign-in as needing e-mail (`app-catalog-felhom.eu/FIRST-ADMIN.md`). | OPEN — filed 2026-10-15 | — | On 9202: set Ghost up, sign in from a second browser, see whether a code is asked; if so, switch the app's e-mail on or set the flag off in the template | CC | -| **R-1091** | Apps & catalog | P3 | **Catalog copy that is wrong or stale at the pinned tag, found writing the guides — each needs an operator word or a live check, so none was changed tonight.** From source at each app's tag (evidence per app in `audits/app-guides-2026-10-15/B/`): (1) **calcom** use_case and first_steps promise Google Calendar / Outlook sync — the compose sets neither app's keys, so only Apple Calendar and CalDav are offered (a promise, so the operator's); (2) **bentopdf** tagline and use_case say files are processed „on the server" — they are processed in the browser, and some tools load code from a public CDN (a privacy promise, so the operator's); (3) **sabnzbd**, **nzbget** use_cases say Radarr/Sonarr/Jellyseerr hand them jobs — the box wires only qBittorrent and Transmission (`mediawire.go`), and a hand link needs a path mapping; (4) **onlyoffice** first_steps 3–4 tell the household to wire Nextcloud by hand — the integration toggle does it (`internal/integrations/onlyoffice_nextcloud.go`); (5) **glance**, **homepage** first_steps send the household into config files in a Docker volume no household tool reaches; (6) **lubelogger** starts with only the „Dashboard" tab and in miles (shipped `appsettings.json`), so first step 3 cannot be done as written; (7) **home-assistant** first_steps promise auto-discovered devices — the app runs on a Docker bridge, where mDNS/SSDP were measured deaf (spike R-6); (8) **homebox** and **gitea** `add_people` name menus that moved or read differently at the tag; **bookstack** `default_creds` still says `admin@admin.com / password`, which after_install replaces; **dawarich** names the API key's page „Settings" (source suggests the account page); **code-server** says „install your tools" with no sudo; **komga** names the discontinued Tachiyomi; **seerr** `docs_url` points at Overseerr; **wanderer**'s comment still says it cannot close sign-up (R-714 is fixed in the same file); (9) **nzbget** and **grafana** deploy-field descriptions say the password can be changed later — nzbget re-applies its env password at every start and grafana ignores the field after first start (R-1086 is the qBittorrent/Transmission side). | OPEN — filed 2026-10-15 | Operator: (1) and (2) are promises — reword to what is true? | Live-check (5)–(7) and (9) on 9202; fix (3), (4), (8) as copy with the freeze re-admitted; re-run the guide label check for any app whose copy moves | CC | +| **R-1091** | Apps & catalog | P3 | **Catalog copy that is wrong or stale at the pinned tag, found writing the guides — each needs an operator word or a live check, so none was changed tonight.** From source at each app's tag (evidence per app in `audits/app-guides-2026-10-15/B/`): (1) and (2) **DONE 2026-10-16** (operator decision D12: reword): calcom's use case now names Apple Calendar or a CalDAV calendar instead of Google/Outlook, and bentopdf's tagline and use case say the browser does the work and the file stays on the device (catalog CHANGELOG 2026-10-16); (3) **sabnzbd**, **nzbget** use_cases say Radarr/Sonarr/Jellyseerr hand them jobs — the box wires only qBittorrent and Transmission (`mediawire.go`), and a hand link needs a path mapping; (4) **onlyoffice** first_steps 3–4 tell the household to wire Nextcloud by hand — the integration toggle does it (`internal/integrations/onlyoffice_nextcloud.go`); (5) **glance**, **homepage** first_steps send the household into config files in a Docker volume no household tool reaches; (6) **lubelogger** starts with only the „Dashboard" tab and in miles (shipped `appsettings.json`), so first step 3 cannot be done as written; (7) **home-assistant** first_steps promise auto-discovered devices — the app runs on a Docker bridge, where mDNS/SSDP were measured deaf (spike R-6); (8) **homebox** and **gitea** `add_people` name menus that moved or read differently at the tag; **bookstack** `default_creds` still says `admin@admin.com / password`, which after_install replaces; **dawarich** names the API key's page „Settings" (source suggests the account page); **code-server** says „install your tools" with no sudo; **komga** names the discontinued Tachiyomi; **seerr** `docs_url` points at Overseerr; **wanderer**'s comment still says it cannot close sign-up (R-714 is fixed in the same file); (9) **nzbget** and **grafana** deploy-field descriptions say the password can be changed later — nzbget re-applies its env password at every start and grafana ignores the field after first start (R-1086 is the qBittorrent/Transmission side). | OPEN — filed 2026-10-15 | — | Live-check (5)–(7) and (9) on 9202; fix (3), (4), (8) as copy with the freeze re-admitted; re-run the guide label check for any app whose copy moves | CC | | **R-1092** | Apps & catalog | P4 | **Three apps show no guide: plant-it and home-assistant carry one HIDDEN (`checked_version: ""`), emby has none.** plant-it: `lifecycle: abandoned`, and its pinned image does not exist upstream, so there is no screen to check labels against. home-assistant: its frontend follows the browser language and the Hungarian strings are fetched at build time, not kept in git, so the Hungarian labels cannot be checked against source (the draft is written; the shipped frontend in the image could check them). emby: its server's web UI is in no public source at 4.11.0.4. Evidence: `audits/app-guides-2026-10-15/B/`. The other 62 templates show a checked guide (controller ≥ 0.315.0). | OPEN — filed 2026-10-15 | — | home-assistant: check the Hungarian labels against the frontend files in the pinned image (read-only, on a box running it), then set checked_version; emby: label-check against the image's own web files the same way; plant-it: nothing while abandoned | CC | | **R-981** | Apps & catalog | P3 | **The homepage app gets the Docker socket (that is root in the guest) and has no login, no setup gate and no family gate.** Fix: remove the socket mount, or put homepage behind the family gate. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Change the catalog template; prove on 9202 | CC | | **R-971** | Apps & catalog | P2 | **A change pushed to the catalog's `main` reaches the installed apps on every box within about 15 minutes, and nothing on the box refuses dangerous container settings (privileged mode, the Docker socket, host mounts, host namespaces); so whoever can push to the catalog repository can take every guest.** Design-shaped: installed apps take catalog fixes on purpose. Decision for the operator in `STATUS.md`. Fix options: a privilege allow-list check on the box before any compose is written (and in catalog CI), and later signed catalog releases. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — confirmed by a second reader | operator decision | Decide; then build the box-side check | operator | @@ -215,12 +214,11 @@ stopping line that lies. | **R-1076** | Storage & devices | P4 | **A cheap SSD reports a vendor-less WWN, so a WWN-first disk key may not be unique.** MEASURED 2026-10-15 on the N100's system SSD (AirDisk 512 GB): `ID_WWN=0x5000000123456f1f` — NAA-5 with OUI `000000`, a pattern that looks like a placeholder; its serial `QDF922W009654S30EX` looks real. The agent's wipe binding prefers `wwn-` links (A/internal/storage/durable_device.go:32). Not known whether two units share the WWN. Evidence: `audits/storage-identity-2026-10-15/B-n100.txt`. | OPEN | — | Check a second unit of the same model (or vendor data); if shared, make the agent skip OUI-000000 WWNs (the design already keys on model+serial, `architecture/16-storage-physical-identity.md` §3). | CC | | **R-1077** | Storage & devices | P4 | **No USB enclosure that hides or fakes a disk's serial has been measured.** The storage-identity spike (2026-10-15) had none at hand and found none in earlier evidence; the design's `usb_bridge` unknown rule (`architecture/16-storage-physical-identity.md` §3) is therefore an assumption. Cheap single- and dual-bay bridges are known to report one bridge serial for any disk. Evidence: `audits/storage-identity-2026-10-15/README.md` case 4b. | OPEN | — | Buy or borrow one cheap USB enclosure (single and dual bay), run `tools/physdisk_probe.py` against it, and set the rule from what it reports. | Operator (a device) then CC | -## Security & access — 22 rows (P1 2, P2 4, P3 10, P4 6) +## Security & access — 21 rows (P1 2, P2 3, P3 10, P4 6) | ID | Category | Sev | What | State | Blocked on | Next action | Owner | |---|---|---|---|---|---|---|---| | **R-1033** | Security & access | P1 | **Every box answers its public names over plain `http://` — login pages included.** MEASURED 2026-10-14 from DooPlex over the public path (Cloudflare `Server: cloudflare`, `CF-RAY`): `http://felhom.enkicsifelhom.hu/login` → 200, `http://felhom.enkisfelhom.hu/login` (demo-hp) → 200, `http://torrent.enkicsifelhom.hu/` → 200; no redirect to https and no `Strict-Transport-Security`. Sonarr, Radarr and Prowlarr make it worse: their sign-in redirect is ABSOLUTE `http:///login`, so a household that opened the https address lands on the plain page and sends its password unencrypted between the browser and Cloudflare (`audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt`). On an untrusted network (café Wi-Fi) that password can be read. The operator may raise this to P1. | **NARROWED** — filed 2026-10-14; **P1 by the operator 2026-10-14 22:13 (`09` §3 decision 244)**. FIXED in controller v0.312.0 (traefik sends every `http://` to `https://`, 301, path and query kept; HSTS one day; decision 246) and PROVEN on Tester 1, demo-hp and demo-felhom (29 public names, `scripts/https_only_check.py`; https answers unchanged), delivered by hand. Open: the fleet delivery — vouch 0.312.0 and the floor (morning); Tester 2 (`sajatfelhom.hu`, 0.292.0, off) gets it with the floor | the operator's vouch + floor | Vouch controller 0.312.0, raise the floor; then run `scripts/https_only_check.py` on every box and close | CC | -| **R-1088** | Security & access | P2 | **CC's credentials file was overwritten with one token, and that token was printed once into a session transcript.** 2026-10-15 22:03 (local): a CC session called `scripts/read_credential.py HUB_TOKEN ~/.config/credentials` — the second argument is the OUTPUT file, so the reader wrote the hub token over the whole file; every other key (dashboard passwords, the box passwords) is gone from DooPlex. At 20:43 UTC the storage-identity build B session listed the file's „key names" with `sed 's/=.*//'`; the file had no `=`, so the token itself was printed into that session's transcript. The token is CC's scoped hub token (floor only; no secrets, no deletes). **The session that did it was the app-guides night** (it stopped at once, touched the file no more, and told the operator in the terminal). **The guard is built (same night, felhom.eu):** `read_credential.py` refuses an OUTFILE that is the credentials file by path, symlink or hard link, before reading or writing; pinned by `test_the_outfile_can_never_be_the_credentials_file`, red-proved (`audits/app-guides-2026-10-15/credential-guard-redproof.txt`). **2026-10-16: the operator restored the file from backup** (17 keys present; CC checked the key names only, no value read). **The owed demo-hp rendering check then ran (07:20 UTC):** login 302 + session, Plex and Sonarr guide pages in Hungarian and English, 4 `data-guide-section` + 1 FAQ block each, every rendered string equal to the catalog, negative control seen failing (`audits/app-guides-2026-10-15/render-check-2026-10-16.txt`). **Left open: the token rotation** — the operator did not say it was rotated, and a file restored from a backup taken before the incident holds the same token that was printed. | OPEN | Operator: rotate CC's hub token. | Rotate the hub token (`05` §17) and write the new one into `~/.config/credentials`; then close this row. | Operator | | **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator | | **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC | | **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC |