security review: STATUS (four decisions) and REPORT-security-review-2026-10-12.md

STATUS.md

@@ -5,6 +5,33 @@
 **Updated 2026-10-12 (your 38 answers): hub 0.147.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
 0.308.0. The open-items list is at 97 (2026-10-12: your 38 answers, 32 closed, 1 opened). Reports: `REPORT-answers-2026-10-12.md`, `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
 
+## Monday 2026-10-12 (evening): security review — the hub is closed again; four decisions for you
+
+- **The hub's old master key is dead.** It was in public git history and still worked. Changed today with your yes;
+  the old key is now refused. All three boxes kept reporting.
+- **The open hub page is closed.** Hub 0.148.0 is live: the customer list and box reports now need the master key.
+  Tested, red-proved, and checked on the live hub.
+- **We cannot tell if a stranger used either hole before today.** The logs only go back to this morning (and one day
+  in June). The holes were open since February — about 238 days we cannot see. Decision 1 below.
+- **One box cannot read another box's data on the hub** — checked in the code and with tests (5 new ones).
+- **The review found 18 more things to fix** (3 serious, the rest medium or small). Each is a row; the next tasks are
+  ranked in `documentation/audits/security-review-2026-10-12/FINDINGS.md`. The papers do not say how to use an open hole.
+- **A gate test wrote into the shared repository** while this session pushed from a separate copy: it put the name „d"
+  on two of another session's commits and was probably what flipped `core.bare` (R-935). Fixed by hand; noted on R-935.
+
+**Waiting on you:**
+- Put the new hub master key into your password manager (entry „Felhom hub global bearer (report_api_key)") from
+  `/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/new.key`, then `shred -u` that file.
+
+**Your four decisions** — the question, **my pick**, what the other option costs, what happens if you do nothing:
+
+| # | Row | Question | Pick | The other option | If you do nothing |
+|---|---|---|---|---|---|
+| D1 | R-954 | Change the break-glass root password of every box now, because we cannot see if the old key was used? | **Yes, change them** (Tester 1 holds a real person's data; ep0 holds copies) — about one hour, one box at a time, through the existing vault | Accept: no work, but a password that may have been read stays valid on every box | the old root passwords stay; if they were read, they still open the boxes from the LAN or console |
+| D2 | R-971 | Should the box refuse a catalog change that asks for dangerous container rights (privileged mode, the Docker socket, host mounts)? | **Yes — an allow-list on the box** (one controller release; the few apps that need a right are listed) | Keep trusting the catalog repository: no work, but whoever can push to it reaches every box | a catalog push keeps reaching every box's apps with no check |
+| D3 | R-985 | Our „zero-knowledge" promise: change the wording, or remove the operator's root reach to the backup key on a live box? | **Change the wording now** („we cannot read your off-site backup without you — except on a live box, where we hold the break-glass key"); revisit after the first sale | Remove the reach: a design change to break-glass | the promise stays stronger than the product |
+| D4 | R-982 | Should root log in over SSH with a password from the LAN? | **No — key only**; the password stays for the console | Keep it: nothing to do, anyone on the household network can try the password | the host keeps accepting root password logins from the LAN |
+
 ## Monday 2026-10-12 (afternoon): your 38 answers — built, released and delivered (Parts A–G); the list from 128 to 97
 
 - **All 38 answers are written down** (decisions 196–233). Your words won where they differed (S1, S2, S8, S32, S37).