9 Commits

Include renames

Author	SHA1	Message	Date
admin	00686789e1	hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 13:33:25 +02:00
admin	368ee9878d	hub v0.153.0: no token sends, mints or reveals a household credential or link (operator ruling 13:20, 09 §3 decision 252) ... - Session only: claim-resend, customer create, customer edit (changes the e-mail), create-config; pinned with selfbind-link, regen-password, appliance bind by TestToken_CredentialAndLinkRoutesAreSessionOnly (red-proved x2). - Customers write keeps block/unblock/geo. R-1055 closed; R-1059 filed (off-site re-issue, operator decision). Not deployed — waits for the operator's yes. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 13:26:05 +02:00
admin	d62cc08b2e	hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38) ... - Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once, stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it. - Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only: secrets shown/minted, deletes/resets, password, tokens. - R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test. - Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open. - 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS. - website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push. Not deployed — waits for the operator's yes. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-15 12:20:35 +02:00
admin	554b237ba9	Media build docs: 15 BUILT + §11 (evidence per part, measured traps); capability D13; 03 eject with media apps; 07 per-drive binds in no tier; 13 the fresh-Plex boundary; register: 9 rows closed (FIXED v0.313.0), R-1023/R-1045/R-1049 waiting on the operator, R-1028 narrowed, R-1022 teardown + Media D ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-15 10:57:40 +02:00
admin	b7807c1198	https only (R-1033, P1): controller v0.312.0 proven on Tester 1, demo-hp, demo-felhom (29 names); scripts/https_only_check.py; 01/13/poster facts; decision 246 (decided by CC unattended); R-1033 P1 narrowed; R-1041..R-1043	2026-10-14 22:49:54 +02:00
admin	170d090e7b	R-1007 closed: proven live on demo-hp — a real power cut mid-upload, 41 of 41 broken photos repaired by Immich itself, 120 controls untouched ... Docs 02/05/07/13 and capability F12 (PROVEN-LIVE); the audit's C and D sections; R-1020 (the duration reads 0) and R-1021 (the hub build builds a stale checkout) filed; STATUS one screen. Register 133 -> 140 (this session: opened 2, closed 1; another session added 6). Both plugs ON. Report: REPORT-immich-repair-2026-10-14.md. Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-14 17:50:17 +02:00
admin	94fc3ba9c8	Power-cut fixes: spike C1–C4 + Immich repair spike (F); docs 03/07/13/14; R-1003 + R-1000 closed (FAQ live), R-1006..R-1009 narrowed, R-1010 filed; estimator raise STOPPED (one verdict flips); uninstall knows the new helper	2026-10-14 11:55:19 +02:00
admin	81e64c6fe8	Doc 14: turning the machine off (R-998) — path, guards, the hub's 14-day hold, the threat; F11; R-1000 filed ... 03 §6 lists /guest/reboot and /host/poweroff; 13 counts 38 local-API routes and names the new power of attacker (e). Hub CHANGELOG corrected: os_ring0_stalled is NOT held (a fleet rollout alarm, on purpose). R-983: the GET reboot fixed (six remain). R-1000: the website FAQ line.	2026-10-13 20:36:42 +02:00
admin	0b7a8dbf63	architecture 13: the threat model (draft) from the security review	2026-10-12 17:18:08 +02:00