2283 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	6ee23a3b8f	R-1303: watch — abandoned templates are GAP, a seed's unread pins stay pending (no storm after a seed); 38 checks	2026-10-26 23:34:29 +01:00
admin	1f62d62915	R-1303: the nightly security watch — security_watch.py, the shared pin list + upstream gate, 35 tests, the CI job (03:40 UTC)	2026-10-26 23:20:06 +01:00
admin	97ae7086c0	R-1303 (P2): the security watch — spike: which notice sources catch the controls; R-1304 (P3): traefik v3.7.13 inside 12 October advisories	2026-10-26 22:57:07 +01:00
admin	ae3db89ab3	night fixes 2026-10-26: live proofs (R-1220, R-1232, R-1187, R-1298), register states, design lines; R-1300 filed; R-528 design ... Evidence audits/night-fixes-2026-10-26/ (scanned: 0 secret hits).	2026-10-26 22:17:36 +01:00
admin	cc0fb962f3	R-1300 CLOSED: controller 0.345.1 (cloudflared 2026.10.3) on every box; R-1301 filed (N100 host clock, chrony fails at boot); 01: cloudflared follows Cloudflare's security notices	2026-10-26 21:41:05 +01:00
admin	f680720ecd	STATUS: R-1300 (P1) — the tunnel's bad-certificate trust, until 0.345.1 reaches each box	2026-10-26 20:58:42 +01:00
admin	ffb91d89e7	R-1300 (P1, Security): cloudflared 2026.9.3 trusts the eMudhra weak-key intermediates — the list, the origin check (not affected), evidence	2026-10-26 20:50:39 +01:00
admin	3720bd1f03	audits: R-972 govulncheck before/after (Go 1.27.3)	2026-10-26 20:42:41 +01:00
admin	d625a1437d	hub build(R-972): Go 1.27.3 + golang:1.27.3-alpine3.24 builder (GO-2026-6809) — govulncheck 1 → 0 called	2026-10-26 20:42:35 +01:00
admin	09b5f02fc3	hub(R-1218): never replace a recovery package that seals the off-site key with one that seals none (409) ... SaveHostEscrowWithIdentity refuses (ErrEscrowWouldDropRepoKey); the PUT answers 409. Red-proved (store: superseded=true; API: 500). Two older tests pinned the old demotion and are updated. Commit only.	2026-10-26 20:21:08 +01:00
admin	99c0f5e310	D55 = 260 recorded (09 §3 decision 268); the grant set and read back; R-1299 filed (no grant button)	2026-10-26 20:11:22 +01:00
admin	3ca9b71c73	R-435 read and closed: the 2026-10-26 windows (hub records + mailbox; box logs lost to restarts, said plainly)	2026-10-26 19:17:19 +01:00
admin	4955744462	docs: STATUS D55 (the D54 grant needs the operator: CC's token lacks offsite:write; the cap), R-1294/R-1297 rows, CONTEXT	2026-10-26 19:06:41 +01:00
admin	e33ec8210a	D53 built + live-proven (08 §10 [DESIGN — built]); R-1297 decoys: register-shape decoys assert the script's exit ... - 08 §10: built (controller 5bd03ad, hub 7e57e824, commit only); putback_pending as on the wire; as-built notes - audits/d53-held-apps-2026-10-26: live proof on 9202 against a test hub (3-min grace), red-proofs, teardown - R-1291 BUILT (not released); R-1298 filed (9202's orphan holds + PrivateBin leftover) - test_gate_decoys.py: the register-shape cases also run the script and assert its exit code — R-1297's decoy 2 showed an inert main() passed every case (9 cases red with it now) - audits/r1297-ci-trim-2026-10-26: runners, times, decoys	2026-10-26 19:03:07 +01:00
admin	7e57e824a2	hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace ... app_held / app_hold_cleared allow-listed and operator-only; handleEvent mirrors them in held_apps; HeldAppsChecker sends ONE app_held_reminder (warning, operator-only, per-app cooldown) after the grace per reason (6 h / 1 d / 3 d), then weekly; recorded before sending; stale rows not reminded; the hub never clears a hold. Test-only alerting.held_app_grace_override. TestD53_* in api/monitor/notify/web, red-proved by six mutations. Commit only.	2026-10-26 18:25:00 +01:00
admin	ecd82abab8	ci(R-1297 A): heavy suites by path on a branch push, all on a tag and nightly; no second full gate run ... - script_tests_gate.py: test_gate_decoys / test_due_checks_gate / dooplex-offsite run on a CI branch push only when one of their paths changed (FELHOM_CHANGED_FILES); no list, an empty or unreadable list = every suite - gates.yml: nightly schedule 03:20 UTC; the list is set only for push:refs/heads/*; a trimmed commits array (total_commits > listed) is an unknown list - test_repo_gates.py and test_due_checks_gate.py group G drive the real runner with GATES narrowed to their labels, instead of the whole gate set a second time (130 s each in CI) - red-proved: filter cases, workflow pins (old gates.yml), inert run_gate, unregistered due-checks	2026-10-26 18:14:23 +01:00
admin	8143a2c872	docs: record D53, D54 and R-1297 (B) (09 §3 decisions 265-267); STATUS moves the two picks to history	2026-10-26 18:07:22 +01:00
admin	2354b9084c	2026-10-26 afternoon: R-1295 and R-1292 closed (hub 0.172.0 + tenantsync v1.4.0 on ep0; controller 0.345.0, floor 13:27:04Z); R-1297 filed (CI speed, operator: both); STATUS (D53, D54), CONTEXT, the run's report.	2026-10-26 14:33:48 +01:00
admin	69443d3c4e	hub v0.172.0 RELEASED (13:08 UTC); felhom-tenantsync v1.4.0 INSTALLED on ep0 (operator yes); R-1292 live on Tester 1 (PASS; run 1 was an instrument failure, kept).	2026-10-26 14:17:07 +01:00
admin	a90a9745a8	hub: image 0.172.0 (R-1295; operator yes 2026-10-26)	2026-10-26 14:04:22 +01:00
admin	232f42d21e	R-1295 live on hub rc.1 (a fresh Tester4 install set up its whole-guest off-site tier; the box consumed the credential and made its first copy); R-1294 read: an honest plan the cap can never catch up with (D54); R-1291 design (08 §10, D53); design lines for R-1295, R-1285, R-1292, R-1294; R-1296 filed; STATUS.	2026-10-26 13:42:47 +01:00
admin	ee38dee2c9	hub: image 0.172.0-rc.1 (R-1295 live proof; operator yes 2026-10-26)	2026-10-26 12:45:52 +01:00
admin	722013da90	R-1295: the PBS DR set-up waits out PBS's 5-s permission cache. Cause measured on a throwaway PBS 4.2.5 under load (v1.3.0 failed 11/30, v1.4.0 0/30): tenantsync v1.4.0 re-checks the same token (and the admin token) up to 15 s; hub v0.172.0 retries a self_check_failed rollback 3x, 7 s apart, and a final failure mails the operator (pbsdr_provision_failed, operator-only). Red-proved. Commit only; ep0 unchanged.	2026-10-26 12:27:28 +01:00
admin	c69f53055d	2026-10-26 release run: hub 0.171.0, agent 0.166.0 (vouched), controller 0.344.0 (global floor 09:07:47 UTC), catalog 73c165d, golden 0.344.0 (baked, vouched; a fresh install came up on 0.344.0); the golden waiver removed — the gate is green on the golden. Rows: 9 closed (R-1278, R-1280–R-1283, R-1286–R-1289), R-1285 back to OPEN, R-1294 and R-1295 filed; STATUS, CONTEXT, evidence (scanned, 0 hits).	2026-10-26 10:42:54 +01:00
admin	6efb47607f	hub: image 0.171.0 (R-1287, R-1289; operator yes 2026-10-26)	2026-10-26 08:53:49 +01:00
admin	7ad7c99684	D52: the golden waiver renewed for 2026-10-26 only (expires 2026-10-27) — the Sunday bake was missed; the golden is baked today on v0.344.0 and the waiver goes after the vouch. D51 (Start) and D52 recorded (09 §3 263, 264; CONTEXT; STATUS-HISTORY).	2026-10-26 08:37:12 +01:00
admin	1550b1da5a	R-1183 CLOSED (measured 2026-10-26, two channels: the hub log and DooPlex's push journal — each daily job once, on its CET hour; the morning of 10-25's hub log is gone, named). R-1293 filed (P4): on the fall-back night the 02:30 push runs before the hub's second 02:00, so that copy never reaches ep0; dated check 2027-03-29.	2026-10-26 08:23:31 +01:00
admin	b00d5c6107	D51 ruled by the operator: Start. Kimai's crash-loop hold lifted 2026-10-26 06:57:03Z, both containers healthy, 0 restarts; R-1286 to VERIFY (install_id at the next controller start; holdWhy rides v0.344.0); D51 off STATUS.	2026-10-26 08:08:01 +01:00
admin	9258cdd11c	Night 2026-10-25 Part 4–5: each fix's [DESIGN] line (04, 05, 07, 08, 11, 13, 15), the register (R-1261, R-1281, R-1282, R-1288, R-1280, R-1285, R-1283, R-1287, R-1289, R-1278 to VERIFY; R-1286 waiting on the operator; R-1291 and R-1292 opened), STATUS (D51 Kimai, the Monday list), the night report with its three-layer teardown, and the rig evidence (scanned: 0 known-secret hits)	2026-10-25 23:47:13 +01:00
admin	f63284861e	hub v0.171.0 (unreleased): a set-aside-only backup digest mails as a warning that says nothing failed (R-1287); a test build is never the fleet's newest (R-1289). Red-proved. Commit only.	2026-10-25 21:21:18 +01:00
admin	68ee667a83	Night 2026-10-25 Parts 1–3: every named artifact still downloads; installer 1.36.1 published (operator yes) and its three refusal sentences seen live; D50 = A recorded (09 §3 262, CONTEXT, build skill); R-1284 and R-1290 closed; R-1261 rig evidence so far	2026-10-25 20:52:56 +01:00
admin	b841192670	webpage: the installer git-sync (sidecar + init) follows installer-v1.36.1 (R-1284; operator yes 2026-10-25)	2026-10-25 20:11:34 +01:00
admin	79ee3e3392	Release close-out (attended, 2026-10-25): hub 0.170.0, agent 0.165.0 (vouched), controller 0.343.0 (global floor), catalog ebbf1f4; D49 = A and D44–D46 recorded (09 §3 258–261, CONTEXT, 07 §6.3/§8.2e); 9 rows closed, R-1254 hub half, R-1250 dated check 2026-10-27; R-1287–R-1290 filed; STATUS, map, REPORT-release-2026-10-26 installer-v1.36.1	2026-10-25 19:30:10 +01:00
admin	36ef8dcdec	installer 1.36.1: http_code prints one status (R-1284, red-proved; committed, not published); R-1285 (BYO drop-in removed one bundle late), R-1286 (demo-hp kimai held since 10-14); release-2026-10-26 evidence: BYO proof, the three boxes on 0.343.0, Homepage gate on the drill	2026-10-25 18:32:04 +01:00
admin	ade357a14e	D44/D45 = all picks applied (R-1265, R-1266 closed; R-1280–R-1283 opened); R-232 dated check done; release-2026-10-26 evidence: fix A/B live on rc.6, D47 set-aside alarm on rc.7	2026-10-25 17:57:11 +01:00
admin	a86ab64f6c	hub v0.170.0 (R-1254: the recovery package in one transaction) — manifest bump, operator yes in the attended release run	2026-10-25 16:46:40 +01:00
admin	1d4abca54a	Release run 2026-10-26: hub CHANGELOG names v0.170.0 (R-1254) for the build; the run's evidence folder (fix A/B red-proofs, probe)	2026-10-25 12:59:14 +01:00
admin	9647f1d158	Restore-truth run (2026-10-25): D47 + D48 recorded (09 §3 decisions 256, 257; CONTEXT); 07 §6.5 (R-1271 cause + the future-date rule), §6.6 (D48 order, the R-698 sentence), §8.2d (D47), §8.2e (R-1270); register 217 -> 219 (R-1278, R-1279 opened; R-1269/1270/1271 VERIFY; notes R-1206, R-1243 dated check done read-only, R-232 moved one day); STATUS D49 + Monday list; evidence (9202)	2026-10-25 11:04:46 +01:00
admin	67053335d1	Catalog sweep 2026-10-24: all 65 catalog apps on a fresh box (52 work, 10 with a problem, 0 broken); register 208 -> 217 (R-1269..R-1277 opened; notes on R-739, R-1267); STATUS + D46; map B1 re-checked; evidence ... Every catalog app installed, used, backed up, removed keeping data, reinstalled, restored and removed with data on a fresh box from the public ISO (demo-hp VM 9360, Tester4), endpoint-level. Worst: a reinstall's capture rewrites the kept unit so its restore breaks the app (R-1269, P2), the restore still reports success (R-1270, P2), and „use my kept data" loaded another box's future-dated database (R-1271, P2). Drill catalog fixes for the morning list (n8n usage data; OpenGist 256M, proven by a cgroup probe). VM 9360 and LXC 9361 destroyed; hub host Tester4-aa9466 left for the operator. REPORT-catalog-sweep-2026-10-24.md.	2026-10-25 00:13:05 +02:00
admin	3add386aa9	Restore-holes run (2026-10-24 night): D43 = A recorded; 07/05/03/11 carry the R-1251, R-1252, R-1254 and D43 rules; register 207 -> 208 (R-1268 opened; R-1251/1252/1253/1257 VERIFY, R-1254 NARROWED); STATUS Monday list + D44/D45 picks; evidence (Tester 1, 9202)	2026-10-24 21:08:38 +02:00
admin	dcf4f84cb7	hub R-1254 (P2): the escrow key, its hash and the identity blob in ONE transaction; a bad identity blob is refused before anything is stored. Committed, not deployed.	2026-10-24 20:37:59 +02:00
admin	80f1ab3167	Review round 2: CI numbers by hash in the session report	2026-10-24 16:29:40 +02:00
admin	876d92367e	Review round 2 (batch 2 + close-out): 02/07/09/10/11/14/15/16/inventory facts corrected at file:line (EDITS.md), undocumented decisions as notes (R-1265), rulings left for the operator (R-1266); register 190 -> 207 (R-1251..R-1267 opened: R-1251 P1 cut drive-app restore put back over newer data, R-1252 P2 rejected backup block deletes second-drive copies - reproduced on 9202); STATUS D43-D45; CONTEXT; audit README	2026-10-24 16:12:30 +02:00
admin	77015997f8	Review round 2, part 1 (batch 1): 01/03/04/05/06/08/12/13/_hub-review facts corrected against live code (each at file:line, EDITS.md); 20 capability rows marked re-check; poster timeline text; live-probes path; reviewer candidates and the H1/H2 proofs	2026-10-24 15:46:33 +02:00
admin	44d1904286	DooPlex backup alarms: one cause (the dump job's password after the reboot), fixed; alarm mail quieter; R-1250 proven ... R-232 dated note + a dated check for tonight's sweep; R-934 closed (the disk was pulled 2026-10-23); R-1250 fixed on main, live proof on demo-hp with a real seed; 08 §9 item 5. Evidence audits/dooplex-alarms-2026-10-24/.	2026-10-24 13:53:57 +02:00
admin	6018486fcc	Attended release run done: controller 0.342.0 the global floor, agent 0.164.0 vouched, hub 0.169.0; R-1244 and R-1247 closed (register 193 -> 191); capability F13; STATUS; the run report	2026-10-24 10:37:27 +02:00
admin	01bf4e83a9	Deploy hub 0.169.0 (the upload watch's four operator-only events; the System page's Upload line) on the operator's yes; agent 0.164.0 delivery + vouch evidence	2026-10-24 09:46:42 +02:00
admin	1a788f332d	Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193	2026-10-24 09:18:44 +02:00
admin	3363ffa89a	D40 (R-1243): the hub's volume out of DooPlex's Longhorn backup — PVC label default: disabled (operator 2026-10-24)	2026-10-24 07:57:23 +02:00
admin	0003115092	Deploy hub 0.168.0 (R-975: the last plain tokens sealed) on the operator's yes; CONTEXT: the 2026-10-24 07:22/07:26 rulings (D40, D41, D42, the iperf3 line test)	2026-10-24 07:33:36 +02:00