diff --git a/documentation/architecture/00-capability-map.md b/documentation/architecture/00-capability-map.md index 2a05cffd..392b89a9 100644 --- a/documentation/architecture/00-capability-map.md +++ b/documentation/architecture/00-capability-map.md @@ -88,7 +88,7 @@ | [A12](capability-map-detail/A.md#a12) | A customer's file survives a machine rebuild and comes back — the whole off-site story, end to end | hub v0.94.0, agent v0.125.0, controller v0.197.0 | **PROVEN-LIVE** | the success path; the failure path is not claimed (R-379, R-380) | `audits/DRILL-r201-night-run-2026-08-04.md` (2026-08-04); `audits/DRILL-r356-hot-only-restore-2026-08-22/` (2026-08-22); `audits/DRILL-r356b-driveless-db-restore-2026-08-22/` (2026-08-22) | | [A13](capability-map-detail/A.md#a13) | The customer's own UNAIDED recovery journey, end to end | controller v0.206.0, hub v0.98.0, agent v0.127.0 | **PROVEN-LIVE** | fifth walk, scoped — read what it does not claim | `tests/walk5-r201-2026-08-07/journal.md` (2026-08-07); `audits/CAMPAIGN-11-recovery-journey-2026-08-05.md` (2026-08-05) | | [A14](capability-map-detail/A.md#a14) | A random night of household actions while random things go wrong — twelve rounds, unattended | controller v0.245.0, agent v0.131.0, hub v0.116.0, golden 0.245.0, ISO 1.28.0 | **PROVEN-LIVE** | nested box, twelve chaos rounds | `audits/DRILL-chaos-night-2026-09-17.md` (2026-09-17) | -| [A15](capability-map-detail/A.md#a15) | A stranger's FIRST HOUR on a fresh install — download → install → claim → two apps → use → backup → remove → restore, plus a power cut and a mistyped code | controller v0.242.0, agent v0.130.0, hub v0.112.0, golden 0.242.0, installer ISO 1.26.1 | **PARTIAL** | every mechanism passed; the unaided journey failed before the first app | `audits/DRILL-fresh-install-0242-2026-09-14.md` (2026-09-14); `audits/DRILL-new-household-2026-09-30.md` (2026-09-30) | +| [A15](capability-map-detail/A.md#a15) | A stranger's FIRST HOUR on a fresh install — download → install → claim → two apps → use → backup → remove → restore, plus a power cut and a mistyped code | controller v0.336.0, agent v0.161.0, hub v0.162.0, golden 0.331.0, installer 1.35.0, ISO 1.29.0 | **PARTIAL** | 2026-10-20: download → install → bind → claim → 8 apps → use → backup → remove → every restore path → power cut → mistyped codes all worked; the 8 GB box FROZE twice in the first afternoon and only a plug pull brought it back (R-1192), and the owner passphrase needed the operator | `audits/rehearsal-2026-10-20/journal.md` (2026-10-20); `audits/DRILL-fresh-install-0242-2026-09-14.md` (2026-09-14); `audits/DRILL-new-household-2026-09-30.md` (2026-09-30) | | [A16](capability-map-detail/A.md#a16) | Off-site app-data capture covers the paths an app declares MANDATORY — on BOTH drive layouts | controller v0.197.0 | **PROVEN-LIVE** | both drive layouts | `audits/DRILL-r201-offsite-recovery-2026-08-04.md` (2026-08-04) | | [A17](capability-map-detail/A.md#a17) | Recurring offsite (PBS) whole-guest backups actually LAND, and RESTORE — local daily + offsite weekly as scheduled work | agent v0.97–0.103, controller v0.174/0.175, hub v0.76.0, host-install 1.20.0 | **PROVEN-LIVE** | demo-hp | `audits/SPIKE-r82-phase0-2026-07-26.md` (2026-07-26) | | [A18](capability-map-detail/A.md#a18) | Restore-proof is UNATTENDED — the scheduler covers EVERY tier, follows the BACKUP rather than the clock, and a failure is heard | agent v0.104.0 → v0.121.0, hub v0.77.0 → v0.91.0 | **PROVEN-LIVE** | — | *(evidence not on file — not re-verifiable)*: the row cites per-repo CHANGELOGs and the spec `backlog/SPEC-r85-phase4-5-2026-07-26.md` — a spec, not a run record | diff --git a/documentation/architecture/capability-map-detail/A.md b/documentation/architecture/capability-map-detail/A.md index 4bf7367a..26f8106a 100644 --- a/documentation/architecture/capability-map-detail/A.md +++ b/documentation/architecture/capability-map-detail/A.md @@ -292,6 +292,18 @@ likewise silent. Evidence: `audits/DRILL-r361-2026-08-22/evidence/06-part3-decis **Gap / roadmap (as written):** Rows **R-493 … R-500**, R-534 … R-545, R-719 … R-727 +**Update 2026-10-20 (rehearsal, Tester4 on demo-hp; controller 0.336.0, agent 0.161.0, hub 0.162.0, golden 0.331.0, +installer 1.35.0, ISO 1.29.0):** still **PARTIAL**. [FACT] Every mechanism of the first hour worked with a pretend +household in a real browser and through the page endpoints: the ISO from felhom.eu/letoltes (sha256 matched), install +(4 min to the pairing code), bind (two wrong passphrases refused, the third right), claim (a typo refused), the recovery +code ceremony (16 s), eight apps installed (Jellyfin refused for memory, with a clear sentence), a family's use, „Mentés +most", remove keeping data and „use my kept data" (47/47 documents back), all seven customer restore paths +(`audits/rehearsal-2026-10-20/B8-restores/README.md`), a power cut in the middle of an install (clean rollback, +`B6-failures/s1-power-cut-mid-install/`). [FACT] The journey still FAILS unaided: on the minimum 8 GB machine the +first afternoon's ordinary uploads froze the box twice (≈1 h and ≈35 min, a relapse after each return) and only pulling +the plug brought it back (R-1192); the owner passphrase reached the household only through the operator (2 h 4 min); +the ten places a household gets stuck are in `audits/rehearsal-2026-10-20/B10-stuck/README.md`. New rows R-1192 … R-1199. + --- diff --git a/documentation/audits/rehearsal-2026-10-20/A6-plan/order.md b/documentation/audits/rehearsal-2026-10-20/A6-plan/order.md index 78bfc0b4..857afb85 100644 --- a/documentation/audits/rehearsal-2026-10-20/A6-plan/order.md +++ b/documentation/audits/rehearsal-2026-10-20/A6-plan/order.md @@ -50,7 +50,7 @@ the filler goes to a share with Felhőmentés OFF and is deleted before the nigh #10 three days off (+#15 inside it), #1 power cut mid install, #14 kept data, #11 if an update exists (none expected — the catalog is frozen). Reason: the clock scenarios move the box's time and would spoil the first night's record. -## Amendment 2026-10-20 20:40 UTC — before any post-night scenario ran +## Amendment 2026-10-20 20:27 UTC — before any post-night scenario ran - **#1 and #14 ran before the night** (20:00–20:14), not after it: they do not move the clock, so they could not spoil the night's record, and the morning is short. Their results are in `B6-failures/s1-…` and `s14-…`. The drawn order of diff --git a/documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md b/documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md new file mode 100644 index 00000000..ba0ea8de --- /dev/null +++ b/documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md @@ -0,0 +1,21 @@ +# B10 — the ten places a household gets stuck (rehearsal 2026-10-20) + +Ranked by what it costs a real family: lost data or a dead box first, then lost time, then confusion. +Each point names what the family SAW, what it would do next, and the record (register row or B9 word). + +| # | where | what the family saw | what a family would do | cost on the day | record | +|---|---|---|---|---|---| +| 1 | first afternoon, normal use | the dashboard and every app stopped answering, twice, ~1 h and ~35 min; a relapse after each return | wait, then pull the plug (the only thing that brought it back) | ~2 h of a dead box; two hard power cuts | R-1192 (P1) | +| 2 | bind page | a „tulajdonosi jelmondat" (owner passphrase) they do not have; two wrong tries of five used | phone Felhom; wait | 2 h 4 min waiting for the operator (09:57 → 12:01) | intervention 1; W4 | +| 3 | a power cut during a full off-site restore | the app runs again, on the BACKUP's older data, while the page says only „megszakadt — indítsd el újra" | believe the app is fine, or start the restore again over newer data | newer data gone, unnoticed | R-1195 (P2) | +| 4 | drive pulled during uploads | each upload was confirmed; after the drive came back the last files were 0 bytes or missing; nothing said so | find out weeks later | silent loss of the last seconds of uploads | R-1196 (P3) | +| 5 | mail | the family's notification page shows disk-warning, drive-disconnected and backup-failed mails ON; on the day the family received one alarm mail in all; the operator received the rest | not know anything is wrong | every warning of the day missed | R-1199 (P2), R-1193 | +| 6 | family card | „Ödön" and „Írisz" refused: „A név 1–32 karakter: kisbetű, szám, pont…" | guess „odon"; some will give up | minutes; a bad first impression | W12 | +| 7 | new drive (storage init) | a required „Csatlakoztatási név * /mnt/…" field, empty; the button silently did nothing | press again; give up | the 200 GB disk unused until someone helps | W13 | +| 8 | sharing („Megosztás") | „A megosztási szolgáltatás előkészítése folyamatban…" for ever — it waits for a share password the page never asks for | wait; ask for help | no shared folder until found | W21 | +| 9 | errors in English | a failed restore, a failed off-site run, a failed install all show raw technical English („offbox backup immich: exit status 1…", „starting stack rallly: exit code 1…") | cannot tell what broke or what to do | a call to support each time | W22, W25, s1/s6/s5 READMEs | +| 10 | wrong „Első lépések" | Mealie's steps name the wrong address (mealie.… while the app is at recipes.…); Paperless says log in as „admin" while the family chose its own name; Vaultwarden says sign-up is closed while the family opened it | follow the steps, fail, think the app is broken | minutes per app; trust lost | W17–W19 | + +Close behind (not in the ten): the download link that does not look like a link (W2); the second disk never offered as +the backup place (R-1198); Jellyfin refused for memory with no help choosing what to remove (W20); the recovery-code +page full of operator words (W10); Actual Budget wholly in English (W23). diff --git a/documentation/audits/rehearsal-2026-10-20/tools/clockctl.sh b/documentation/audits/rehearsal-2026-10-20/tools/clockctl.sh new file mode 100755 index 00000000..bce5e085 --- /dev/null +++ b/documentation/audits/rehearsal-2026-10-20/tools/clockctl.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# clockctl.sh — B6 #7/#8/#10: move the rehearsal VM's clock from OUTSIDE (rehearsal 2026-10-20). +# The VM's own clock only; demo-hp's clock is never touched. Runs from DooPlex, acts on demo-hp. +# clockctl.sh ntp-off drop NTP (UDP 123) and NTS-KE (TCP 4460) leaving the VM's tap (positive control: counters) +# clockctl.sh ntp-on remove that table +# clockctl.sh counters show the drop counters +# clockctl.sh boot clean shutdown, set the VM's RTC start date (UTC), start +# clockctl.sh boot-real clean shutdown, remove the start date, start +# clockctl.sh stop clean shutdown only (box „off") +# clockctl.sh boxtime the box's own clock, read from its HTTP Date header (a different channel than the RTC setting) +set -euo pipefail +VM=${VM:-9320}; TAP=tap${VM}i0; TBL=rh1020ntp; IP=${BOX_IP:-192.168.0.133}; HOSTH=${BOX_HOST:-felhom.tester4.test} +down() { + ssh demo-hp "LC_ALL=C qm shutdown $VM --timeout 300 || LC_ALL=C qm stop $VM" + echo "down $(date -u +%T)" +} +case "$1" in + ntp-off) + ssh demo-hp "nft add table bridge $TBL && nft add chain bridge $TBL c1 '{ type filter hook forward priority 0; }' && \ + nft add rule bridge $TBL c1 iifname $TAP udp dport 123 counter drop && \ + nft add rule bridge $TBL c1 iifname $TAP tcp dport 4460 counter drop && nft list table bridge $TBL"; echo "ntp off $(date -u +%T)";; + ntp-on) ssh demo-hp "nft delete table bridge $TBL"; echo "ntp on $(date -u +%T)";; + counters) ssh demo-hp "nft list table bridge $TBL | grep counter";; + boot) down; ssh demo-hp "LC_ALL=C qm set $VM --startdate $2 && LC_ALL=C qm start $VM"; echo "started with RTC $2 at real $(date -u +%T)";; + boot-real) down; ssh demo-hp "LC_ALL=C qm set $VM --delete startdate && LC_ALL=C qm start $VM"; echo "started with real RTC at $(date -u +%T)";; + stop) down;; + boxtime) echo "real $(date -u +%FT%TZ) box $(curl -sk -m 10 -D - -o /dev/null -H "Host: $HOSTH" https://$IP/api/health | tr -d '\r' | sed -n 's/^[Dd]ate: //p')";; + *) echo "usage: $0 ntp-off|ntp-on|counters|boot |boot-real|stop|boxtime" >&2; exit 1;; +esac