2244 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	3add386aa9	Restore-holes run (2026-10-24 night): D43 = A recorded; 07/05/03/11 carry the R-1251, R-1252, R-1254 and D43 rules; register 207 -> 208 (R-1268 opened; R-1251/1252/1253/1257 VERIFY, R-1254 NARROWED); STATUS Monday list + D44/D45 picks; evidence (Tester 1, 9202)	2026-10-24 21:08:38 +02:00
admin	dcf4f84cb7	hub R-1254 (P2): the escrow key, its hash and the identity blob in ONE transaction; a bad identity blob is refused before anything is stored. Committed, not deployed.	2026-10-24 20:37:59 +02:00
admin	80f1ab3167	Review round 2: CI numbers by hash in the session report	2026-10-24 16:29:40 +02:00
admin	876d92367e	Review round 2 (batch 2 + close-out): 02/07/09/10/11/14/15/16/inventory facts corrected at file:line (EDITS.md), undocumented decisions as notes (R-1265), rulings left for the operator (R-1266); register 190 -> 207 (R-1251..R-1267 opened: R-1251 P1 cut drive-app restore put back over newer data, R-1252 P2 rejected backup block deletes second-drive copies - reproduced on 9202); STATUS D43-D45; CONTEXT; audit README	2026-10-24 16:12:30 +02:00
admin	77015997f8	Review round 2, part 1 (batch 1): 01/03/04/05/06/08/12/13/_hub-review facts corrected against live code (each at file:line, EDITS.md); 20 capability rows marked re-check; poster timeline text; live-probes path; reviewer candidates and the H1/H2 proofs	2026-10-24 15:46:33 +02:00
admin	44d1904286	DooPlex backup alarms: one cause (the dump job's password after the reboot), fixed; alarm mail quieter; R-1250 proven ... R-232 dated note + a dated check for tonight's sweep; R-934 closed (the disk was pulled 2026-10-23); R-1250 fixed on main, live proof on demo-hp with a real seed; 08 §9 item 5. Evidence audits/dooplex-alarms-2026-10-24/.	2026-10-24 13:53:57 +02:00
admin	6018486fcc	Attended release run done: controller 0.342.0 the global floor, agent 0.164.0 vouched, hub 0.169.0; R-1244 and R-1247 closed (register 193 -> 191); capability F13; STATUS; the run report	2026-10-24 10:37:27 +02:00
admin	01bf4e83a9	Deploy hub 0.169.0 (the upload watch's four operator-only events; the System page's Upload line) on the operator's yes; agent 0.164.0 delivery + vouch evidence	2026-10-24 09:46:42 +02:00
admin	1a788f332d	Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193	2026-10-24 09:18:44 +02:00
admin	3363ffa89a	D40 (R-1243): the hub's volume out of DooPlex's Longhorn backup — PVC label default: disabled (operator 2026-10-24)	2026-10-24 07:57:23 +02:00
admin	0003115092	Deploy hub 0.168.0 (R-975: the last plain tokens sealed) on the operator's yes; CONTEXT: the 2026-10-24 07:22/07:26 rulings (D40, D41, D42, the iperf3 line test)	2026-10-24 07:33:36 +02:00
admin	20fa831eaf	Upload watch night data: one-second reads of the real push on three boxes (spike 2.1); R-1245 gets the measured floor; R-1214 dated check read (stays WATCHING); weekend-night report	2026-10-24 04:44:25 +02:00
admin	a91d0b2421	Upload watch: spike, design (08 section 9, proposed), live proofs on 9202; rows R-1244..R-1248 (register 189 -> 194); STATUS D41/D42 + the Monday list ... Spike: per-app normal levels on three boxes (19-31 days), the off-site push as a line measure (a lower bound), qBittorrent/Transmission/Plex explainers measured on 9202, a tc ceiling measured (not built). Live on 9202 with 0.342.0-rc.1: limit set; real seed explained; CPU burner and the hidden flood alarmed once each and cleared once; the household's limit left alone. Teardown: apps removed, 9202 back on 0.341.0, receiver 9471 destroyed.	2026-10-23 22:52:41 +02:00
admin	af5c005a4e	hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail ... app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9, operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.	2026-10-23 21:26:36 +02:00
admin	5277d859d5	hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189) ... The Cloudflare tunnel token, Cloudflare API token and git token inside customer_configs.config_json now hold the 05 §16.2 seal (enc:v1:, OFFSITE_SECRET_KEY). Old rows sealed once at start-up without a config_version bump, then VACUUM + WAL checkpoint (an UPDATE leaves the old plaintext in a freed block). -unseal-box-secrets opens them too. Eight tests, each red-proved. Built, not deployed. Audit: documentation/audits/hub-token-seal-2026-10-23/.	2026-10-23 19:48:17 +02:00
admin	8257ff1cbe	Plex2Shell impact on Felhom: verdict NOT REACHED; R-1241 (P1), R-1242 (P3) opened (register 186 -> 188) ... Read-only audit of whether the hacked Plex pod on DooPlex (HM-040, 2026-10-17 -> 10-23) reached Felhom's secrets. Two no-login doors existed (the Longhorn NFS export and the Longhorn API); neither was used: nfsd accepted 0 new connections in the window (positive control), no off-schedule Longhorn backup or volume. Evidence in documentation/audits/plex2shell-felhom-impact-2026-10-23/. The NFS export was narrowed from * to 10.42.0.0/16 on the operator's yes (host change, not in git). 13-threat-model.md: attacker j and one boundary row. STATUS: verdict, the P1, one do item.	2026-10-23 17:53:43 +02:00
admin	87dc50743c	D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:35:38 +02:00
admin	4b9b0af3cb	Plex2Shell: the operator's 10:56 ruling in CONTEXT; demo-hp 9201 checked (clean) and updated to 1.43.5.11029; register 184 -> 186 (opened R-1238 Plex test record/fixture, R-1239 a fast lane for security fixes = D39); evidence plex-demo-boxes-2026-10-23 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 11:27:52 +02:00
admin	2c9152d912	Day 2026-10-23 close-out: rulings D31-D36 in CONTEXT; STATUS (releases done, do list, D35 dated, D37/D38); register 191 -> 184 (closed R-49 R-982 R-985 R-991 R-1204 R-1205 R-1225 R-1226 R-1227 R-1230 R-1234; opened R-1235 R-1236 R-1237); the break-glass sheet current (D32, one A4, HU+EN); runbooks for D33/D34; poster facts; evidence day-2026-10-23	2026-10-23 11:03:45 +02:00
admin	52af38df6f	hub-db-backup: wait for a snapshot being written, limit 7 h (one slot gap + 1 h) — the 2 h limit refused the hub's own catch-up and mailed a false failure at 10:28 (R-1234, closed); tests red-proved	2026-10-23 10:35:16 +02:00
admin	34979d5d25	hub manifest: 0.165.0 -> 0.167.0 (operator yes 2026-10-23: D31, the clock-ahead tunnel alarm, R-1230, D34 6-hourly snapshot; image sha256:177860a9…)	2026-10-23 10:23:29 +02:00
admin	0bb57a4fee	website: publish D3/D5 (the whole truth on privacy; the minimum machine) and D36's two sentences, HU + EN (operator yes 2026-10-23; R-985, R-991, R-1225, R-1226)	2026-10-23 10:16:54 +02:00
admin	2aebf1bde1	webpage: serve installer-v1.36.0 (both git-sync pins; operator yes 2026-10-23 — root SSH by key only on new installs, R-982 D4)	2026-10-23 10:08:09 +02:00
admin	d306b8c2d7	release-copy: the released images (skopeo dir:, digest-true) and agent packages copied to ep0 nightly, verified by sha256 and a checksum compare, capped at 3 GB (D33, R-1227); tests red-proved	2026-10-23 09:39:31 +02:00
admin	be7e97dc1a	hub 0.167.0 + DooPlex push: the hub DB snapshot every 6 hours (D34, operator yes 2026-10-23, R-232 G5) — slots 02/08/14/20, catch-up 6 h, push :30 after each, refuse a copy older than 2 h; tests red-proved	2026-10-23 09:12:08 +02:00
admin	83388c088a	felhom-host-install.sh 1.36.0 (pushed, NOT published — the tag waits for the operator's yes): the uninstall removes the root-SSH drop-in, a failed reload warns (R-982, D4, reviewed v2 patch) installer-v1.36.0	2026-10-23 08:29:20 +02:00
admin	a408256c7e	REPORT-night-2026-10-23: the night report (five lines, parts 1-5, findings -> verdicts, the test night PASS, teardown in three layers, commits + CI); STATUS: the test night's verdict in the morning list; Nextcloud sha256 + teardown evidence	2026-10-23 07:39:27 +02:00
admin	7802da7298	Dated checks 2026-10-23 done: R-32 (Tester4's listing 72 -> 80, none vanished after Tester 2's RESET), R-1173 (demo-hp's PBS tier started with nothing in flight; the busy branch still test-only); R-548: demo-hp's local tier refused 4 times by space tonight, apps stopped before each refusal	2026-10-23 07:30:13 +02:00
admin	1cb3e57133	Register 189 -> 191 (R-1232 a reinstalled box's first ep0 copy may come a week late — likely; R-1233 an error line naming nothing); test-night evidence: night jobs, D21 on the box, no copy container left, off-site leg/proof/integrity, controller log, agent journal (sudo noise trimmed), recorder, outside probe, loader logs, Immich per-user counts, night numbers	2026-10-23 07:13:52 +02:00
admin	5dc17cab03	test night: controller fixture 2 (rc.8) recorded	2026-10-23 00:07:06 +02:00
admin	f56f3328f7	Register 187 -> 189: R-1230 (a held box reported stuck — measured on the test night, fixed in hub 0.167.0 source), R-1231 (the recovery page calls an unknown agent older); test-night provenance	2026-10-23 00:07:01 +02:00
admin	e94d0256d2	test night evidence: agent fixture 2 (0.162.99 = agent main b9b831f), the off-site unlock with the household's recovery code (first refused: a pre-release fixture version reads as an unknown capability)	2026-10-22 23:56:34 +02:00
admin	14388e218f	hub 0.167.0 source: R-1230 — a box that holds for the household's recovery code is not reported stuck and gets no off-site re-issue (measured on the test night); red-proved	2026-10-22 23:56:20 +02:00
admin	1805f8bbf0	STATUS 2026-10-23 morning: D29-D31 to history; D32-D36 (the DooPlex survey and two website sentences); the morning list in the brief's order (hold or go, controller, agent + installer, hub 0.167.0, website, discards, the DooPlex hour); verdict of the test night at 07:00	2026-10-22 23:39:06 +02:00
admin	70a600d0c2	Register 180 -> 187 (opened R-1223..R-1229: the tunnel reboot gap, the per-customer cooldown, two website sentences, the registry and the home line and ArgoCD from the DooPlex survey); R-1214/R-1204/R-1205 READY, R-1187/R-982/R-925/R-232/R-923/R-924 updated; rc.8 re-proof of the stray-copy fix on 9202	2026-10-22 23:25:16 +02:00
admin	c6649dd49b	hub 0.167.0 source: the stale-tunnel text no longer promises 15 minutes flat (15 min after the agent sees the sign, plus its next desired-state fetch) — review N8	2026-10-22 23:00:46 +02:00
admin	7585443227	night 2026-10-23 so far: D30 live proof (re-key → new-key handshake; ep0-started handshakes heal a short clock jump by themselves), D4 patches v2 after review, test-night install/fixture evidence, DooPlex survival survey (read only) + PLAN, 03/05/07 + CONTEXT, total-loss runbook: MAIL-HOLD shipped	2026-10-22 22:24:48 +02:00
admin	84751cb0ce	hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence	2026-10-22 21:04:42 +02:00
admin	96ac07e168	REPORT-night-2026-10-22: CI 2224 and 2225 green	2026-10-22 18:47:33 +02:00
admin	acc78637d9	night 2026-10-22: the seven 15:47 rulings in effect or ready (D6, D8 live; D21 waits for controller 0.340.0; D3/D5 website patch; D4 two patches); data-loss candidates proven/fixed/filed; R-1214 cause + capped copy proven on 9202; R-1204 alarm built; repos-private read; STATUS morning list + D29/D30/D31; CONTEXT; 03/05/07/09; rows 178 -> 180 (opened R-1218..R-1222, closed R-206, R-992, R-1207)	2026-10-22 18:24:30 +02:00
admin	1100a344d5	night 2026-10-22: D4 as two ready patches (agent bundle + installer uninstall) — a push of the installer would publish it	2026-10-22 17:11:07 +02:00
admin	e267c5e2cd	hub 0.166.0 source: the clock-ahead tunnel alarm wg_tunnel_stale/ok (R-1204, operator-only, edge-triggered); D21 + D4 proof evidence	2026-10-22 17:02:37 +02:00
admin	0639cf0772	night 2026-10-22: D3 wording in the volunteer guides (the website change is a ready patch — a push publishes); D6 drill-reader proof; P3 research; P6 repos-private readers (read only)	2026-10-22 16:22:28 +02:00
admin	1b442bcc2e	Tester 2's RESET checked read only: every leg ok, the first live R-32 purge (folder held no repository; sub-account gone), ep0 namespace+copy+prune job+token gone, no other customer touched (Storage Box 303/62/43 and ep0 2/2/2/1/27 before = after); hand-over: tell the friend go; A20 third firing; R-32 result + dated check for Tester4	2026-10-22 15:04:07 +02:00
admin	82ce9d72d6	Tester 2: a new install, not an upgrade (operator ruling 2026-10-22 14:11) — hand-over list rewritten (host delete then RESET, what each removes, the friend's page in Hungarian); R-862, R-1139 close at the reinstall; R-32's first live purge noted; STATUS, CONTEXT	2026-10-22 14:19:26 +02:00
admin	ecfc09c3ef	day 2026-10-22: R-1199 reopened and closed (hub 0.165.0 + controller 0.339.0; demo-felhom's list restored), R-1216 closed (D28 = A), R-1217 filed; Tester 2 hand-over list; STATUS, CONTEXT, D28 to history; rows 178 -> 178	2026-10-22 13:17:17 +02:00
admin	25dae2f568	hub 0.165.0: deploy (operator yes 2026-10-22) — the household's mail list never overwritten; host_swap_short only when swap is really short	2026-10-22 12:46:27 +02:00
admin	5ae5984cf9	hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated	2026-10-22 12:23:07 +02:00
admin	a92837410a	morning 2026-10-22: ISO 1.30.0 published (W1, W7; gate + proof installs on both entries); download pages point at it; rows 184 -> 178 (closed R-1192, R-1177, R-1178, R-1180, R-1195, R-1199, R-1210; opened R-1216 the host-swap check too strict); STATUS, CONTEXT, report	2026-10-22 10:51:24 +02:00
admin	115f15c89e	morning 2026-10-22 evidence: agent 0.162.0 delivered to the 3 test boxes, controller 0.338.0 on all 3 through the floor, https-only + containers + controller errors green	2026-10-22 10:16:49 +02:00