R-1088: credentials restored by the operator; the owed demo-hp guide page check passed (Plex, Sonarr, HU+EN); rotation left open

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/OPEN-ITEMS.md

@@ -220,7 +220,7 @@ stopping line that lies.
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
 | **R-1033** | Security & access | P1 | **Every box answers its public names over plain `http://` — login pages included.** MEASURED 2026-10-14 from DooPlex over the public path (Cloudflare `Server: cloudflare`, `CF-RAY`): `http://felhom.enkicsifelhom.hu/login` → 200, `http://felhom.enkisfelhom.hu/login` (demo-hp) → 200, `http://torrent.enkicsifelhom.hu/` → 200; no redirect to https and no `Strict-Transport-Security`. Sonarr, Radarr and Prowlarr make it worse: their sign-in redirect is ABSOLUTE `http://<name>/login`, so a household that opened the https address lands on the plain page and sends its password unencrypted between the browser and Cloudflare (`audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt`). On an untrusted network (café Wi-Fi) that password can be read. The operator may raise this to P1. | **NARROWED** — filed 2026-10-14; **P1 by the operator 2026-10-14 22:13 (`09` §3 decision 244)**. FIXED in controller v0.312.0 (traefik sends every `http://` to `https://`, 301, path and query kept; HSTS one day; decision 246) and PROVEN on Tester 1, demo-hp and demo-felhom (29 public names, `scripts/https_only_check.py`; https answers unchanged), delivered by hand. Open: the fleet delivery — vouch 0.312.0 and the floor (morning); Tester 2 (`sajatfelhom.hu`, 0.292.0, off) gets it with the floor | the operator's vouch + floor | Vouch controller 0.312.0, raise the floor; then run `scripts/https_only_check.py` on every box and close | CC |
-| **R-1088** | Security & access | P2 | **CC's credentials file was overwritten with one token, and that token was printed once into a session transcript.** 2026-10-15 22:03 (local): a CC session called `scripts/read_credential.py HUB_TOKEN ~/.config/credentials` — the second argument is the OUTPUT file, so the reader wrote the hub token over the whole file; every other key (dashboard passwords, the box passwords) is gone from DooPlex. At 20:43 UTC the storage-identity build B session listed the file's „key names" with `sed 's/=.*//'`; the file had no `=`, so the token itself was printed into that session's transcript. The token is CC's scoped hub token (floor only; no secrets, no deletes). **The session that did it was the app-guides night** (it stopped at once, touched the file no more, and told the operator in the terminal). **The guard is built (same night, felhom.eu):** `read_credential.py` refuses an OUTFILE that is the credentials file by path, symlink or hard link, before reading or writing; pinned by `test_the_outfile_can_never_be_the_credentials_file`, red-proved (`audits/app-guides-2026-10-15/credential-guard-redproof.txt`). Until the restore, the demo-hp rendering check of the night's guides is owed (it needs the dashboard password). | OPEN | Operator: rotate CC's hub token; restore `~/.config/credentials` from the password manager. | Rotate the hub token (`05` §17); restore the file; then CC re-runs the demo-hp rendering check of the Plex and Sonarr guides. | Operator |
+| **R-1088** | Security & access | P2 | **CC's credentials file was overwritten with one token, and that token was printed once into a session transcript.** 2026-10-15 22:03 (local): a CC session called `scripts/read_credential.py HUB_TOKEN ~/.config/credentials` — the second argument is the OUTPUT file, so the reader wrote the hub token over the whole file; every other key (dashboard passwords, the box passwords) is gone from DooPlex. At 20:43 UTC the storage-identity build B session listed the file's „key names" with `sed 's/=.*//'`; the file had no `=`, so the token itself was printed into that session's transcript. The token is CC's scoped hub token (floor only; no secrets, no deletes). **The session that did it was the app-guides night** (it stopped at once, touched the file no more, and told the operator in the terminal). **The guard is built (same night, felhom.eu):** `read_credential.py` refuses an OUTFILE that is the credentials file by path, symlink or hard link, before reading or writing; pinned by `test_the_outfile_can_never_be_the_credentials_file`, red-proved (`audits/app-guides-2026-10-15/credential-guard-redproof.txt`). **2026-10-16: the operator restored the file from backup** (17 keys present; CC checked the key names only, no value read). **The owed demo-hp rendering check then ran (07:20 UTC):** login 302 + session, Plex and Sonarr guide pages in Hungarian and English, 4 `data-guide-section` + 1 FAQ block each, every rendered string equal to the catalog, negative control seen failing (`audits/app-guides-2026-10-15/render-check-2026-10-16.txt`). **Left open: the token rotation** — the operator did not say it was rotated, and a file restored from a backup taken before the incident holds the same token that was printed. | OPEN | Operator: rotate CC's hub token. | Rotate the hub token (`05` §17) and write the new one into `~/.config/credentials`; then close this row. | Operator |
 | **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator |
 | **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC |
 | **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC |