hub 0.156.0 deployed and verified; R-972 narrowed further

REPORT-burndown2-2026-10-16.md

@@ -19,7 +19,7 @@ OS package are updated; the Debian 13 move is its own row with the re-proof (R-1
 | 1 — Data tab leftovers | **Done** (controller 0.322.0). The export password field: `autocomplete="new-password"`, name `fab_encryption_key`. The 2nd copy's status rows are gone; the form is the one place (its no-target reason moved into it); the warning stays. Browser (headless Chrome through the public address): the field renders with the attribute and stays empty; no status rows; one target label. **Headless Chrome has no saved passwords, so the autofill itself is not proven — the attribute is.** `P1/` |
 | 2 — plain http (R-1033, P1) | **Closed.** The hub's newest reports: demo-hp, Tester 1, demo-felhom on ≥ 0.321.0. `https_only_check.py`: 35 public names → 301 on all three. **Tester 2** (`sajatfelhom.hu`, 0.292.0, off since 2026-10-04) is not checked: both http and https answer Cloudflare 530 (tunnel down). R-1104 checks it when it returns. `P2/` |
 | 3 — the box settings route (R-970, P2) | **Closed.** See §3. |
-| 4 — Go and base images (R-972, P2) | **Controller released, hub built and waiting for your yes, agent committed (no release).** See §4. |
+| 4 — Go and base images (R-972, P2) | **Controller released, hub deployed on your yes, agent committed (no release).** See §4. |
 | 5 — dead install-form branches (R-1103, P4) | **Closed.** The installed-only branches of `app_fields.html` removed. Retired tests and where their rule is now: `TestDeployPage_DeployedApp_DoesNotCarryTheSecret` → `TestAppPage_LoginPairPanel` + `TestR255_NoPlantedSecretReachesAnyPage`; `TestR709_AnInstalledAppsPasswordIsNotInThePage` → the same two (its install-form half stays as `TestR709_TheInstallFormKeepsItsGenerator`); `TestR694_TheDeployPageDoesNotOfferAGeneratedLogin` → `TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin` (new, red-proved); the parity cases `deploy_installed` and `deploy_installed_restored`. |
 
 ## 2. https check per box (`P2/https-only.txt`)
@@ -73,8 +73,8 @@ then with 0.14.0 (rc.2) on the same store — „backup OK", 186 snapshots. The
 - **felhom-controller** `8fe46a1` → `f037be7` (R-970, Data tab, R-1103) → `fc77fcb` (Go 1.27.2) → `52619e8`
   (Debian 12.13) → `e9d0d72` (CHANGELOG, `apt-get upgrade`) → docs. Test images rc.1 (Debian 13), rc.2, rc.3 (demo-hp
   only); release **0.322.0**, MinAgent 0.158.1.
-- **felhom.eu** `836d64ef` → `9d6f3b46` (hub 0.156.0) → this commit. **Hub 0.156.0 is pushed to the registry, NOT
-  deployed** — waiting for the operator's yes.
+- **felhom.eu** `836d64ef` → `9d6f3b46` (hub 0.156.0) → this commit. **Hub 0.156.0 deployed** on the operator's yes
+  (`6999c15f`, manifest tag only): see §5a.
 - **felhom-agent** `dd8b2ac` → `37b99d7` (Go 1.27.2, not released).
 - **Fixtures re-captured (8):** `app_data_deployed`, `app_data_export`, `app_data_notarget_disabled`,
   `app_data_target_auto`, `app_data_target_ssd`, `deploy_new`, `deploy_new_blocked`, `deploy_new_memory_blocked`
@@ -89,6 +89,16 @@ per-box floors cleared. Read back on two channels: the hub's own `/configuration
 `-wal` + `-shm` (integrity ok, newest report 12 min old): `min_controller_version` 0.322.0, `…declared_min_agent`
 `0.322.0=0.158.1`, the three per-box floors empty.
 
+## 5a. The hub deploy (operator's yes, 2026-10-16)
+
+`manifests/hub.yaml` tag 0.155.0 → 0.156.0 (`6999c15f`). ArgoCD hard refresh: only `Deployment/hub` out of sync; only it
+was synced. Synced/Healthy at the pushed revision; the pod runs `felhom-hub:0.156.0`, 0 restarts; its log says
+`felhom-hub 0.156.0 starting`, no error line. **Positive observables:** reports from demo-felhom, demo-hp and Tester 1 at
+19:27 and 19:31 (the hub's log); the hub's `/configuration` page (HTTP 200) shows 0.322.0 and 0.158.1
+(`release/hub-page-floor.txt`); a database copy with its WAL after the start (`release/hub-0.156.0-after-deploy.txt`).
+**CI:** every commit of this task green by job. The controller docs commit failed first (job 1959): its CI read the
+register before the felhom.eu push that added R-1105; re-run after that push, green.
+
 ## 6. Observations
 
 1. Tester 2 is not checked for plain http while it is off. FILED: R-1104
@@ -102,4 +112,4 @@ per-box floors cleared. Read back on two channels: the hub's own `/configuration
 - **Machine:** demo-hp 9201 ran rc.1, rc.2, rc.3, then the release by the floor; two by-day backup runs (off-site
   included). The door-check script ran inside the controller container and was removed; the key never left the box.
 - **Host:** nothing.
-- **Hub:** per-box floors set and cleared; the global floor raised (the release). Hub image 0.156.0 pushed, not deployed.
+- **Hub:** per-box floors set and cleared; the global floor raised (the release). Hub 0.156.0 deployed (only `Deployment/hub` synced).

STATUS.md

@@ -6,7 +6,7 @@
 `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
 
 ## What works
-- **The hub's key can no longer open anything on a box** (controller 0.322.0, 2026-10-16): the settings route is gone, and every former door answers 401 even with the box's own key. Every box that reports answers only over https (35 names). The controller is built on a supported Go (1.27.2): known Go weaknesses in it 62 → 1, fixable OS ones 0.
+- **The hub's key can no longer open anything on a box** (controller 0.322.0, 2026-10-16): the settings route is gone, and every former door answers 401 even with the box's own key. Every box that reports answers only over https (35 names). The controller and the hub (0.156.0, deployed at your yes) are built on a supported Go (1.27.2): known Go weaknesses in each 62 → 1; the hub has 0 high findings.
 - **RomM game saves are in the backup now** (2026-10-16, catalog): a save survived a backup, a removal and a restore on demo-hp, byte for byte. Eight apps no longer claim „a known, shared password" (your D10 = A). If someone changes the file manager's password in the file manager, the box notices and offers a new one (controller 0.321.0).
 - **Every installed app says where its login is, and has a „Fájlok ↗" button to its folder** (controller 0.320.0, 2026-10-16). The file manager is shown as part of the box again, with its password; on a box that does not know that password, one press sets a new one (done on demo-hp and, at your yes, on the N100).
 - **Every app but three has a user guide and an FAQ, in Hungarian and English** (catalog, 2026-10-15 night): the „Útmutató” tab shows it on boxes with controller 0.315.0 or newer. Every button name in a guide was checked in the app's own files at the version we ship; a guide that could not be checked stays hidden (plant-it, home-assistant), and Emby has none (R-1092).
@@ -53,7 +53,6 @@
 | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
 
 ## Waiting on you — do
-- **Say yes in chat to deploy hub v0.156.0** (built, scanned: 0 critical, 0 high; no code change — only the new Go and Alpine). If you do nothing: the hub keeps running on Go 1.24 with 36 known high findings.
 - **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot.
 - **Look at `roms/roms/` on the N100's drive in the file manager (R-1099).** RomM now scans `roms/<platform>/`. A game uploaded through RomM before today sits one folder deeper: if there are platform folders in `roms/roms/`, move them up into `roms/` and press „Scan” in RomM. If not: those games show under a platform called „roms”.
 - **Nézd meg a Calibre-Web oldalát a demo-hp-n** (`felhom.enkisfelhom.hu`, controller 0.319.0, minden dobozon kiadva). A fejléc, a fülsor és minden rész most külön panel (az „A” stílus). A belépési adatok egy panelben vannak, egymás mellett. A Calibre-Web jelszaváról a doboz nem tud, mert az alkalmazás előbb települt, mint hogy a sablonban jelszó lett volna — ezt most egy mondat mondja ki. Ha nem tetszik, írd meg, mit változtassak. Ha nem nézed meg: semmi nem romlik el.

documentation/audits/burndown2-2026-10-16/release/hub-0.156.0-after-deploy.txt

@@ -0,0 +1,5 @@
+hub 0.156.0 started 2026-10-16 17:26:19 UTC
+integrity ok
+report after deploy ('demo-hp-bb76ea', '2026-10-16 17:37:45')
+min_controller_version ('0.322.0',)
+min_controller_version_declared_min_agent ('0.322.0=0.158.1',)

documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt

@@ -1 +1,2 @@
 hub page /configuration shows 0.322.0: 3 times
+hub 0.156.0 /configuration: HTTP 200, '0.322.0' appears 3 times, '0.158.1' 3 times

documentation/backlog/OPEN-ITEMS.md

@@ -247,7 +247,7 @@ stopping line that lies.
 | **R-982** | Box system & updates | P3 | **The Proxmox host accepts root password login over SSH from the LAN (measured on demo-hp), so anyone on the household network can try the root password.** Design-shaped: the break-glass password exists for the console. Fix: key-only SSH for root; the password stays for the console. Evidence: `audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt`. | OPEN — design-proposal | — | Decide; then set it in the installer and the config bundle | CC |
 | **R-979** | Box system & updates | P3 | **Controller updates are trusted by registry tag alone (no digest, no signature), and the Update button offers any newer tag, even an unvouched one; the built-in traefik, cloudflared and FileBrowser images are also pinned by tag only.** Whoever can push to the registry decides what runs. Fix: pin by digest from the hub's vouched list; offer only vouched versions. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN — design-proposal | — | Design note, then build | CC |
 | **R-974** | Box system & updates | P3 | **A compromised host agent can likely become root on the host through the root wrapper that applies PBS settings: the wrapper accepts a folder path inside the agent's own writable tree and then acts on it as root.** Static (the symlink behaviour was reasoned, not run). Same class as R-861. Fix: a fixed root-owned folder, and refuse symlinks before any root action. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Fix the wrapper with a test on a throwaway box | CC |
-| **R-972** | Box system & updates | P2 | **The shipped controller and hub programs are built with Go 1.24.13 and golang.org/x/crypto v0.31.0, and the agent with Go 1.26.0, so dozens of fixed Go security bugs (including html/template escaping fixes) are still in what runs on boxes and the hub.** Go 1.24 has had no security fixes since Go 1.26 was released (Go supports the two newest major releases: https://go.dev/doc/devel/release#policy); the scanners name fixes in Go 1.26.9 and 1.27.2. Also: the controller image's Debian 12 base has 12 fixable critical packages, and the Samba image has 48 fixable high ones. Fix: build all three on a supported, patched Go; update x/crypto; rebuild the base images. Scanner output: `audits/security-review-2026-10-12/scanners/`. | **NARROWED** 2026-10-16 (burndown 2): **controller v0.322.0 released** on Go 1.27.2 + x/crypto v0.58.0, runtime debian:12.13-slim + `apt-get upgrade` (Debian 13 deliberately not: restic 0.18, R-1105) — scanner: critical 16 → 4, fixable criticals and highs in the OS 0; govulncheck 62 → 1 (module-level, `openpgp` not linked). **Hub v0.156.0 built** (Go 1.27.2, alpine 3.24.2: 0 critical, 0 high) — deploy waits for the operator's yes. **Agent: Go 1.27.2 committed (`37b99d7`), tested, NOT released** — the next vouched agent release carries it. Open: the Samba image (48 fixable high, not rebuilt); docker-compose plugin's own Go (4 high, upstream). Evidence `audits/burndown2-2026-10-16/P4/` | the operator's yes for the hub deploy; the next vouched agent release | Deploy hub v0.156.0 on the yes; rebuild the Samba image on its current base; close when the agent release carries Go 1.27.2 | CC |
+| **R-972** | Box system & updates | P2 | **The shipped controller and hub programs are built with Go 1.24.13 and golang.org/x/crypto v0.31.0, and the agent with Go 1.26.0, so dozens of fixed Go security bugs (including html/template escaping fixes) are still in what runs on boxes and the hub.** Go 1.24 has had no security fixes since Go 1.26 was released (Go supports the two newest major releases: https://go.dev/doc/devel/release#policy); the scanners name fixes in Go 1.26.9 and 1.27.2. Also: the controller image's Debian 12 base has 12 fixable critical packages, and the Samba image has 48 fixable high ones. Fix: build all three on a supported, patched Go; update x/crypto; rebuild the base images. Scanner output: `audits/security-review-2026-10-12/scanners/`. | **NARROWED** 2026-10-16 (burndown 2): **controller v0.322.0 released** on Go 1.27.2 + x/crypto v0.58.0, runtime debian:12.13-slim + `apt-get upgrade` (Debian 13 deliberately not: restic 0.18, R-1105) — scanner: critical 16 → 4, fixable criticals and highs in the OS 0; govulncheck 62 → 1 (module-level, `openpgp` not linked). **Hub v0.156.0 deployed** 2026-10-16 19:26 on the operator's yes (Go 1.27.2, alpine 3.24.2: 0 critical, 0 high); Synced/Healthy, reports from all three boxes after the start, the floor reads 0.322.0. **Agent: Go 1.27.2 committed (`37b99d7`), tested, NOT released** — the next vouched agent release carries it. Open: the Samba image (48 fixable high, not rebuilt); docker-compose plugin's own Go (4 high, upstream). Evidence `audits/burndown2-2026-10-16/P4/` | the next vouched agent release | Rebuild the Samba image on its current base; close when the agent release carries Go 1.27.2 | CC |
 | **R-862** | Box system & updates | P3 | **Tester 2 cannot take the config bundle until one by-hand bootstrap is done: its `felhom-os-apply` (agent 0.142.0) predates the bundle mode, and no signed job can write a root file on it.** FOUND 2026-10-04 (R-840 build, Part C): the route reaches every box installed from installer 1.31.0 on, and the demo boxes (bootstrapped by CC); Tester 2 has every root file of agent 0.142.0 (installer 1.30.0) and lacks only the R-858 wrapper fix, which matters only for a Docker step it gets solely from a signed job. CC has no route to Tester 2 (its door admits only the operator's WireGuard peer; `felhom-op` cannot become root). The steps: `runbooks/config-bundle.md` "Tester 2". Then CC signs the bundle and reads it back. | **WAITING-ON-OPERATOR** — the operator said (2026-10-04 ~19:05) he will try through his tunnel **2026-10-07 07:58 (`09` §3 decision 170): the operator believes Tester 2 never set up the off-site backup (no escrow); the laptop may stay off for days; the tester plans to add an HDD.** **2026-10-07 (Part H, read only):** in Tester 2's last 10 notifications (2026-10-05 09:16 → 2026-10-07 06:58) the household got 0 mails, the operator 10 (host_down ×9, expected_dbdump_missed ×1); control: the household channel shows on the other three customers. So the household is not mailed daily while the box is off; no row (`audits/day-2026-10-07/H/`). | the operator's WireGuard tunnel | the operator runs the three bootstrap commands; CC sends the bundle | operator |
 | **R-78** | Box system & updates | P3 | **`local_api` authority ruling — auto-reconcile vs detect-only** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-25, size M, roadmap state `idea (deferred OUT of R-77 on purpose)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. **An OWED OPERATOR DECISION, not a defect — moved because an owed ruling hidden among feature ideas is the shape this session exists to remove.** | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | R-77 ships detection because the fix is genuinely undecided, and **both directions can lose customer-visible function**. **Direction 1 (today):** `controller.yaml` wins and drift is silent → the 2026-07-25 island migration blinded the whole fleet's control plane for 17.5 h (drive gate, guest-reboot recovery, quiesce/backup all degrade). R-77 makes that loud but does not stop it recurring. **Direction 2 (`bootstrap.json` wins, auto-reconcile on boot):** a guest whose `controller.yaml` is CORRECT and whose `bootstrap.json` is stale — a half-completed re-provision, a hand-repaired guest, a setup-wizard box — gets a **working channel clobbered on the next restart**, fleet-wide and silently, during a routine deploy. That is not obviously better than the bug. Needs a spike: which writer is authoritative per field (endpoint vs fingerprint vs token — `mergeLocalAPI` replaces the whole block, so they cannot be reconciled independently today), whether the agent side should stamp a generation/mtime so 'newer wins' is even expressible, and whether reconcile should require an operator ack. Until then the drift alert plus a manual edit is the supported path. | CC |
 | **R-468** | Box system & updates | P3 | **[P3-LOW] THE GOLDEN WAIVER — goldens on a cadence, not per release (operator ruling 2026-09-13).** 25 goldens in 26 days in August, almost one per release, because `golden_currency_gate.py` trips on every release by design and the only honest ways past it were a bake or a declared `--no-verify` (thirteen by 2026-09-01, R-404/R-417). **The ruling: bake WEEKLY, and always before any drill or fresh install.** Every release still raises the FLOOR, so both demo boxes keep getting each release in ~20 s; only the golden — which protects a fresh install and nothing else — moves to a cadence. **The mechanism (built 2026-09-13):** `documentation/tests/golden-waiver. **⚠ CORRECTED THE SAME DAY (R-472): between bakes the floor does NOT carry a release — the hub holds any floor above the vouched golden (publish-train rule 1), so releases between bakes reach the demo boxes only by hand-deploy.**yml`, four lines (`issued`, `expires`, `reason`, `register_row: R-468`), read by the gate. While valid, a golden BEHIND the record makes the gate print a loud ADVISORY and exit 0; when it expires the gate is red again until someone bakes or renews. **The 14-day cap is enforced by the gate, not the runbook** — a longer, undated, unparseable, reason-less or row-less waiver is INCONCLUSIVE (exit 2), never 0 and never silently ignored. **It never covers a golden that is UNRECORDED (R-385)** — that is not a cadence choice. **A dated waiver cannot be forgotten; it just expires** — the difference from R-242's original rule, which recurred the day after it was written. Tests: `scripts/test_golden_currency_gate.py` cases 5–15 (E/F/G/H, a 15-day, absent, unparseable, bad-row and empty-reason waiver each 2; the R-421 decoy — a file saying only `expires` — 2). **This is a PRE-CUSTOMER arrangement: the first external install retires it** (delete the file in that commit). Cadence written into `RUNBOOK-manual-build.md` §4.2 and the `felhom.eu` end-of-session checklist. **Does NOT touch R-242's open half (nothing gates the VOUCH).** **2026-10-15 (`09` §3 decision 250, operator):** the cadence is now the RULE, not a waiver — a controller release needs no golden (the floor carries it), the golden is baked every Sunday night when the floor is above it (`runbooks/nightly-rotation.md`), and `golden_currency_gate.py` convicts only a golden MORE THAN 7 DAYS old while a release is ahead (CASE 18–21, red-proved). The waiver file stays as a dated exception for a missed Sunday. | **WATCHING** — the weekly bake is a night-routine step; the first external install still retires the waiver arrangement | — | — | CC |