diff --git a/STATUS.md b/STATUS.md index 9bf06c2e..6ca039c9 100644 --- a/STATUS.md +++ b/STATUS.md @@ -2,7 +2,7 @@ **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.** -**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.150.0 (0.151.0 and 0.152.0 — access tokens — written, not deployed). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day: +**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.152.0 (access tokens; deployed 2026-10-15 evening). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day: `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`. ## What works @@ -41,7 +41,7 @@ | D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — | ## Waiting on you — do -- **Hub 0.152.0 is ready: access tokens (your ruling, 11:38).** It includes 0.151.0 (a mail when a drive comes back). A token lets a script use the hub without your password; you tick what it may do. **Do, in order:** (1) say „yes" and I deploy it; (2) Configuration → Access tokens → create „cc-releases" with *Overview: read* and *Releases: floor: write*, 90 days, and save it on DooPlex as `~/.felhom-hub/cc-token` (`chmod 600`) — do not paste it to me; (3) after I report the token works, change the hub password. If you do nothing: I keep using your password, for the floor only. +- **Hub 0.152.0 is live (access tokens; it includes the drive-back mail).** **Do, in order:** (1) Configuration → Access tokens → create „cc-releases" with *Overview: read* and *Releases: floor: write*, 90 days, and save it on DooPlex as `~/.felhom-hub/cc-token` (`chmod 600`) — do not paste it to me; (2) after I report the token works, change the hub password, and delete the `HUB_PW` line in `~/.config/credentials`. If you do nothing: I keep using your password, for the floor only. - **Decide (R-1055):** a token with „Customers: write" can change a household's e-mail and resend its claim code to it. Keep that, or make „resend claim" password-only? **My pick: password-only** (one line). If you do nothing: it stays as you wrote it; nobody holds such a token now. - **Remove the test server „plex-k6” from your Plex account** (plex.tv → Settings → Authorized Devices). The claim test passed and the server is gone from Tester 1. If not: a dead server stays listed in your Plex apps. - System poster needs a refresh: every public name answers only over https (http → 301). diff --git a/documentation/audits/hub-tokens-2026-10-15/deploy.txt b/documentation/audits/hub-tokens-2026-10-15/deploy.txt new file mode 100644 index 00000000..89cfae8b --- /dev/null +++ b/documentation/audits/hub-tokens-2026-10-15/deploy.txt @@ -0,0 +1,11 @@ +2026-10-15 hub 0.152.0 deploy read-back (CC) +manifest commit 2184897; image digest sha256:73470a6abf42e83b15968ef42b691d1946f7edc7e22c7e18b8715245fa2b2992 +image=gitea.dooplex.hu/admin/felhom-hub:0.152.0 +sync=Synced rev=2184897666e48450d1b09cd65c159bc01d08f9f2 health=Healthy +GET /configuration with Basic: 200, footer 0.152.0, 'Access tokens' card present, 'No tokens yet' +GET /configuration no credential: 302 /login +GET / with an unknown fhp_ token: 401 +GET /api/v1/customers with an fhp_ token: 403 'access tokens are not accepted on /api/v1' +2026/10/15 12:39:55 [WARN] access token refused: unknown token — GET / from 10.42.0.1 → 401 +2026/10/15 12:39:55 [WARN] access token refused on the box API: GET /api/v1/customers +Boxes reporting after the restart (hub DB + WAL copied from the running pod, hosts.last_report_at > 10:39:30 UTC): demo-felhom-8363b5=10:49:40 demo-hp-bb76ea=10:41:03 tester-1-d70be4=10:41:30 (Tester-2 is off since 2026-10-04, known) diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md index a21ef236..3c48dd23 100644 --- a/documentation/backlog/OPEN-ITEMS.md +++ b/documentation/backlog/OPEN-ITEMS.md @@ -274,7 +274,7 @@ stopping line that lies. | **R-844** | Hub & operator | P4 | **The household's OS-update line exists only on the hub's customer timeline.** 2026-10-04: the box itself has no event surface for agent results (the controller UI shows no timeline), so `os_update_applied` is a hub customer event (info: recorded, never mailed). Its stored text is the hub's English sentence; the hu/en bundle text (`mail.event.os_update_applied`) is used only if it is ever mailed. Fix direction: a controller-side line (the controller already polls the agent's local API) when the box gets a household timeline. `audits/os-guest-lane-2026-10-04/partG/hub-customer-timeline-demo-hp.txt` | **READY — owner: CC** **2026-10-05 (burn-down night): NEEDS A DESIGN** — a household timeline on the box does not exist yet. | — | — | CC | | **R-1002** | Hub & operator | P4 | **A box the household switched off reads ONLINE on the hub's hosts page for its first 45 minutes** (seen live 2026-10-13, R-998 proof, `audits/poweroff-2026-10-13/B-hub-watch.log`: the „Power: Kikapcsolva…" line at 18:53, the KIKAPCSOLVA badge only at 19:38, when the host report turned stale). The customer page read „warn" in part of that gap (seen, not captured). No alarm and no mail fired; the operator page is only slow to say it. | **READY** — filed 2026-10-13 | — | CC: let `hostDisplayStatus` read `deliberate_off_at` before staleness, with a render test per state; next hub release | CC | | **R-1011** | Hub & operator | P3 | **The Day-0 „Agent" list offers step-bundle packages (`0.156.1-step1`, `0.152.0-step1` …) as agent versions; one has no agent binary, so the hub shows the bundle JSON's sha (`FileSHA256` falls back to the first file) and a vouch would point fresh installs at a package with no binary.** Seen 2026-10-14 (`/configuration`: two „0.156.1" entries, `ac83ea41…` is the step bundle). | **READY** — filed 2026-10-14 | — | CC: list only versions whose package holds the `felhom-agent` file (refuse a missing preferred file instead of falling back), with a test; next hub release | CC | -| **R-1051** | Hub & operator | P3 | **CC cannot raise the global floor without the operator's own password.** `09` §3 decision 250 lets CC raise the floor after the three test boxes, but the only route was the operator page with the operator password. Operator ruling 2026-10-15 11:38 (`09` §3 decision 251): scoped tokens; until CC's token works, the password for the floor only. | **BLOCKED** — built in hub v0.152.0 (`05` §17: tokens with groups, CC = `overview:read` + `floor:write`), not deployed | the operator's „yes" to deploy v0.152.0; then the operator creates „cc-releases" and saves it to `~/.felhom-hub/cc-token` | Deploy; a no-op floor save with the token, read back; a vouch attempt → 403; a session-only route → 403; then close | operator | +| **R-1051** | Hub & operator | P3 | **CC cannot raise the global floor without the operator's own password.** `09` §3 decision 250 lets CC raise the floor after the three test boxes, but the only route was the operator page with the operator password. Operator ruling 2026-10-15 11:38 (`09` §3 decision 251): scoped tokens; until CC's token works, the password for the floor only. | **BLOCKED** — hub v0.152.0 DEPLOYED 2026-10-15 (`05` §17: tokens with groups, CC = `overview:read` + `floor:write`) | the operator creates „cc-releases" and saves it to `~/.felhom-hub/cc-token` | A no-op floor save with the token, read back; a vouch attempt → 403; a session-only route → 403; then close | operator | | **R-1056** | Hub & operator | P4 | **Five operator routes fit no token group, so they are session only until the operator places them:** apps reset-telemetry and dismiss-issues, the Configuration asset re-seed, the off-site WireGuard endpoint save, the off-site abandon-cancel (`05` §17.3). Nothing needs them by token today. | WAITING-ON-OPERATOR — filed 2026-10-15 by the token build | operator decision | Place each in a group, or leave session only | operator | diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md index f1b03d97..09efa962 100644 --- a/hub/CHANGELOG.md +++ b/hub/CHANGELOG.md @@ -28,7 +28,7 @@ Operator ruling 2026-10-15 11:38 (`09` §3 decision 251). Design: `documentation scope → 403 with the floor unchanged, the allowed floor save lands, no plain token in the DB file or WAL, the CSRF rule for Basic unchanged, a token cannot create a token (route and handler), no password → 503, `main` mounts only `Handler()`, `fhp_` refused on every API route, every non-public API route refuses no credential. -- **Not deployed** — the operator's „yes" first (`09` §3 decision 162). Includes v0.151.0. +- **Deployed 2026-10-15 ~12:39 Budapest** on the operator's „yes" (manifest `2184897`, digest `sha256:73470a6a…`). Includes v0.151.0. Read-back: `documentation/audits/hub-tokens-2026-10-15/deploy.txt`. ## v0.151.0 — a drive that comes back mails too (R-1049) (2026-10-15)