227 Commits

Include renames

Author	SHA1	Message	Date
admin	00686789e1	hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 13:33:25 +02:00
admin	368ee9878d	hub v0.153.0: no token sends, mints or reveals a household credential or link (operator ruling 13:20, 09 §3 decision 252) ... - Session only: claim-resend, customer create, customer edit (changes the e-mail), create-config; pinned with selfbind-link, regen-password, appliance bind by TestToken_CredentialAndLinkRoutesAreSessionOnly (red-proved x2). - Customers write keeps block/unblock/geo. R-1055 closed; R-1059 filed (off-site re-issue, operator decision). Not deployed — waits for the operator's yes. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 13:26:05 +02:00
admin	994c75c0a8	hub 0.152.0 deployed (operator yes): read-back, all three boxes report; STATUS + R-1051 wait on the token ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 12:50:40 +02:00
admin	d62cc08b2e	hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38) ... - Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once, stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it. - Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only: secrets shown/minted, deletes/resets, password, tokens. - R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test. - Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open. - 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS. - website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push. Not deployed — waits for the operator's yes. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 12:20:35 +02:00
admin	12552acabd	hub v0.151.0: a drive that comes back mails too — storage_reconnected / health_recovered paired with their downs (R-1049); not deployed ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-15 08:43:13 +02:00
admin	822d039344	hub v0.150.0: app_repaired_after_crash — allow-listed + operator-only, counts line in the operator mail (R-1007); decision 236 recorded ... The operator's half of the repair after an unclean boot (controller 0.311.0): counts only, never a file name; warning mails, info is recorded. Registered in allowedEventTypes and operatorOnlyEvents in the same commit, plus the per-app cooldown list; tests pin the pair, a household that enabled the type gets nothing, and the counts line (red-proofed). Decision 236 (operator, 2026-10-14): the box asks Immich through Immich's own job queue. R-1007 updated; the scripts' run on 9202 added as evidence. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-14 16:58:35 +02:00
admin	81e64c6fe8	Doc 14: turning the machine off (R-998) — path, guards, the hub's 14-day hold, the threat; F11; R-1000 filed ... 03 §6 lists /guest/reboot and /host/poweroff; 13 counts 38 local-API routes and names the new power of attacker (e). Hub CHANGELOG corrected: os_ring0_stalled is NOT held (a fleet rollout alarm, on purpose). R-983: the GET reboot fixed (six remain). R-1000: the website FAQ line.	2026-10-13 20:36:42 +02:00
admin	a6acb0f762	Hub v0.149.0: clamp a future deliberate-off time; hold a customer only when all its hosts are off (R-998) ... Security review of 50e47e29: requested_at is the box's clock — a future value is cut to the hub's now; CustomerDeliberatelyOff now needs every host of the customer held (one machine of two no longer silences the other), and fails closed on a read error or no host. Both red-proofed.	2026-10-13 19:52:12 +02:00
admin	50e47e29af	Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998) ... hosts.deliberate_off_at follows the agent's deliberate_off field (set, then cleared by the first report of a new boot; one info event each way). While held, every silence alarm is held: host and node staleness, the 05:00 backup deadlines, off-site and restore-test freshness, the OS alarms and the kernel notice. After 14 days the usual alarms fire once, naming the power-off. Pages show KIKAPCSOLVA and the time. Consequence tests with controls; each guard red-proofed.	2026-10-13 19:47:02 +02:00
admin	b67b8cea8f	hub v0.148.0 (code): SECURITY — the customer list and box reports need the operator key (R-951); R-950 rotated; R-952, R-953 filed (97 -> 99 rows)	2026-10-12 16:51:42 +02:00
adminandClaude Opus 5.5	655f5f66f8	hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33 ... - S4 / R-242: GoldenVouchChecker - a published golden unvouched for 2 h raises golden_not_vouched (operator only) - S6 / R-244: the delete cascade de-references app_log_issues; one-time sweep flag -sweep-app-log-residue=count|apply - S10 / R-266: read_failed storage entry shows "read failed", not 0 % - S29 / R-250: host-key scan IPv4 first, ~2 min ladder, "safe to press Save again" error - S30 / R-246: stale_at retired (reader, setter, badge) - S32 / R-521: storage_reconnected ends the storage_disconnected cooldown on both channels - S33 / R-402: host page "Last full check (off-site)" line; two wire-gate allowlist entries removed Each with a test seen failing first. Not built or deployed yet (operator-attended deploy). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-12 14:54:14 +02:00
adminandClaude Opus 5.5	9fbdee83d9	hub v0.146.0: the System page layout (release) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-10 16:13:58 +02:00
adminandClaude Opus 5.5	cf6fec8d87	hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first ... Needs attention, Waiting for you (one card per kernel/Docker/Proxmox set the button may approve), a 7-column Boxes table whose rows open to every old value, and a closed Details (release ids, cancelled approvals, ring-0 counts, floors, crash guard and root files, Approve now - which now asks first). Same data, buttons, routes and CSRF field. No deploy. Screenshots in audits/hub-system-page-2026-10-10/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-10 15:38:25 +02:00
adminandClaude Opus 5.5	ca9408f153	hub v0.145.0: the kernel approval rule (operator ruling 2026-10-10, 09 §3 decision 195) + release entry for the security fix, R-922, MAIL-HOLD ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-10 09:27:54 +02:00
adminandClaude Opus 5.5	e5b9151e05	hub (unreleased, SECURITY): /preferences and /notify refuse a per-customer key acting for another household (403); red-proved ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-09 12:48:54 +02:00
adminandClaude Opus 5.5	d55c590c5a	hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-09 12:37:29 +02:00
adminandClaude Opus 5.5	8dbdac5fc2	hub v0.144.0: CHANGELOG release entry (D1, D2, D3, D6, D7; R-243, R-901, R-304, R-415) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-09 07:02:44 +02:00
adminandClaude Opus 5.5	fe0dc0d03f	Decision sheet D1-D10: hub CHANGELOG, architecture notes (01, 04, 05, 07, 08, 10), register (VERIFY states, R-912), STATUS, report; decoy suite runs in a git worktree ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 15:18:31 +02:00
adminandClaude Opus 5.5	d9147b02de	R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 10:19:39 +02:00
adminandClaude Opus 5.5	5beedcce1a	R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated ... Unreleased; ships with tomorrow's hub release. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 10:09:20 +02:00
adminandClaude Opus 5.5	05becb04d0	R-901: a deleted customer's audit rows go 1 year after the deletion (hub, unreleased); ep0-copy removal job written, not installed (decision 181); both times in the privacy draft ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 09:54:39 +02:00
adminandClaude Opus 5.5	b119301c6f	R-243: offsite_escrow_pending — an operator alarm when off-site is on and the escrow never done (7 days); 09 decisions 177-179; 07 R-899 note ... Hub code unreleased; ships with tomorrow's hub release. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-08 08:00:08 +02:00
adminandClaude Opus 5.5	87765bfa63	hub v0.143.1 (code): Reply-To on household mails (decision 174); R7 told-kernel refusal is temporary (R-898 test) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 18:47:41 +02:00
adminandClaude Opus 5.5	ab3b7ea2f4	hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172) ... KernelDue / KernelNotify (09-20 h Budapest, one per 20 h, max 3, registered address, only an accepted mail counts) / os_update.kernel {kver, tonight} (no mail, no step) / layer kernel ingest + operator events / Approve kernel set after every ring-0 box booted it healthily after a night stage / two System page cells. 11 §5.11 written; §5.10 status corrected (proven). Installer uninstall knows the two GRUB generators (unreleased). Evidence: audits/kernel-lane-2026-10-07/ (red-proofs, boot timing). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 15:34:14 +02:00
adminandClaude Opus 5.5	ed7fff943d	hub v0.142.0: R-812 A, R-32, R-366 slice 2, R-105 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 13:10:21 +02:00
adminandClaude Opus 5.5	9c94a9c6c0	R-366 slice 2 (decision 168): one operator line when the box's whole-guest archives include another key's (edge-triggered) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 10:21:25 +02:00
adminandClaude Opus 5.5	e03b18ea21	R-32 (decision 167): RESET purges the off-site folder through the sub-account's own login before deleting it ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 10:21:25 +02:00
adminandClaude Opus 5.5	aeca52ea54	R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 10:21:25 +02:00
adminandClaude Opus 5.5	e7fb10200e	R-812 option A (hub): the Proxmox package set — candidate, operator approval, System page ... Layer pve: never auto-approved; the candidate is the Proxmox userspace set every ring-0 box reports (kernel / boot / firmware names left out); the operator's "Approve Proxmox set" button appears only after 2 healthy night pve steps on every ring-0 box; an approval nudges no box (ring 1 by a signed os_pve_step). 11 §5.10 written (BUILT, unreleased, not yet proven live); §8 step 6 split (userspace §5.10, kernel R-836). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 10:21:25 +02:00
adminandClaude Opus 5.5	d18ca15a4a	hub v0.141.0: release note ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 08:53:48 +02:00
adminandClaude Opus 5.5	877676a64f	hub v0.141.0: not built tonight — the permission check refused the build ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 00:13:47 +02:00
adminandClaude Opus 5.5	e6af8992ac	hub v0.141.0: R-366, R-31, R-330 (wire) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-07 00:12:05 +02:00
adminandClaude Opus 5.5	b3c835625d	R-330: the hub models SMART 187/188/199 in the host-report (G-1; nothing alarms on them yet) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 22:03:49 +02:00
adminandClaude Opus 5.5	6f8aa46cf7	R-31: a second off-site Save while the first still provisions is refused, not raced ... Both saves used to list no sub-account and create one (a dedicated box is a second bill). Per-customer in-memory claim; the second gets 409 and nothing is saved or created. The async save + status card stays open. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 21:04:54 +02:00
adminandClaude Opus 5.5	0ab96c4adc	Night 2026-10-06: R-366 design + hub CHANGELOG (escrow kept on a backup-key change) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 20:46:37 +02:00
adminandClaude Opus 5.5	eed1dbd80c	hub v0.140.0: a failed operator mail is retried (1, 5, 15 min); a Docker set needs a passing memory-kill check on every ring-0 box (decision 157) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 19:14:00 +02:00
adminandClaude Opus 5.5	c823dc68d3	hub v0.139.0: R-444 System page last disk trim, R-872 early-return log lines ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 11:51:56 +02:00
adminandClaude Opus 5.5	f5400268a7	CHANGELOG: R-444 hub half (unreleased), R-502 full-run gate ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 11:31:12 +02:00
adminandClaude Opus 5.5	307ecdf005	burn-down night watches: R-872 05:00 run worked as designed but silently (Tester 2 34.8 h old) — early returns now log why, check re-dated 2026-10-07; R-887: 2 lost jobs, both re-run green; session report ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-06 05:05:42 +02:00
adminandClaude Opus 5.5	6f78bd9f0e	hub: the Docker set's first-seen is stamped on the evaluate tick, not only by a page view (fixed without a row; flaky page test on a fixed clock) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 21:54:53 +02:00
adminandClaude Opus 5.5	8925dcc633	burn-down night: hub v0.138.0 source (R-879 seal + roll-back, R-136, R-283, R-349/R-276 hub halves), gates R-315/R-422 closed, R-325/R-426 partial, decisions 132-133, 05 §16 (195 -> 193) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 21:48:25 +02:00
adminandClaude Opus 5.5	557629d2bf	hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 19:43:37 +02:00
adminandClaude Opus 5.5	b26d292a64	burn-down Part B: 14 small rows fixed and closed across four repos (306 -> 292); no :latest in the hub build; gate list pinned; closed-id duplicates refused; R-262 subset pinned ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 17:10:38 +02:00
adminandClaude Opus 5.5	f5a0aeb0b8	burn-down Part A: 24 rows closed as fixed by later work, 2 duplicates merged, R-376/R-817/R-818 done (335 -> 306); Part A table ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 16:53:02 +02:00
adminandClaude Opus 5.5	afba622fb6	R-173 option A in force (hub DB nightly to ep0, restore-tested, alarmed); R-519 proven live on 9202 and closed; R-173/R-232 narrowed; R-882..R-885 opened (332 -> 335); runbook §3 tested; hubdb-check ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 16:14:13 +02:00
adminandClaude Opus 5.5	d4be9f6ff1	hub v0.136.0: nightly VACUUM INTO snapshot, keep 2 (R-173 decision A); hub PVC 2Gi + Longhorn default group; 09 rulings 125-127; 05 §16.3 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 14:28:30 +02:00
adminandClaude Opus 5.5	0826e41b31	hub-safety session: R-135/R-133/R-604/R-530/R-508/R-509/R-880 closed, R-861/R-173/R-518/R-519 narrowed, R-879/R-881 opened (336 → 332); 03 §3.1, 05 §16, golden 0.296.0, the hub-DB off-site plan, STATUS ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 13:47:57 +02:00
adminandClaude Opus 5.5	3d7a2761fc	hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 11:12:56 +02:00
adminandClaude Opus 5.5	6da3a7d866	hub v0.134.0: a down box is judged on longer missed-backup lines (R-872); household outage mail at most weekly (R-873); backup_catchup_done allowed (R-871) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 09:24:14 +02:00
adminandClaude Opus 5.5	ff1db11db4	hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-04 20:18:37 +02:00