1361 Commits

Author	SHA1	Message	Date
admin	9db8aacdad	Rehearsal: R-1193 corrected and narrowed to P3 (the operator mailbox shows host_stale at 13:33 and app_oom; the household was told nothing); R-1192 second freeze + the app_oom hint; R-1194 (P3 VERIFY) fresh box's felhom-sshd config invalid; B6 #5 slow-line result	2026-10-20 19:10:42 +02:00
admin	78278502ac	Rehearsal 2026-10-20: second freeze and plug pull, memory watch, Mentés most, B6 #5 started; B9 words W7-W23; tools	2026-10-20 18:32:20 +02:00
admin	2228b9f6b4	Rehearsal: R-1192 (P1) the 8 GB minimum box froze ~1 h on the family's first afternoon, plug pulled to recover; R-1193 (P2) the hub showed it OK throughout; register 170 -> 172; STATUS P1 line and a note on D5	2026-10-20 16:38:27 +02:00
admin	ee743477b4	Rehearsal 2026-10-20 B2-B4: bound (operator passphrase), claimed, recovery code, family (accented names refused), second disk initialised, 8 of 9 apps (Jellyfin refused on memory), first uploads froze the box ~1 h (hub said OK); screenshots gallery	2026-10-20 16:34:30 +02:00
admin	ad6397308c	Rehearsal 2026-10-20: guide §3 quotes the console the box really shows; bind-page screenshots (codes never shown); app upload and gallery tools; R-1189 (d) (e) confirmed in code	2026-10-20 13:17:29 +02:00
admin	d750a90d0e	Data-loss hunt: R-1188 (c) proven — a leftover .felhom-restoring blocks every retry of the second drive's whole restore	2026-10-20 13:11:32 +02:00
admin	a942ae90d6	Data-loss hunt: R-1185 proven (an invalid dump replaces the good one, no error); R-1182 confirmed in code; DST replay of the controller scheduler (once each on 25 Oct; spring 02:30 dump collides with the 03:30 copy)	2026-10-20 13:07:39 +02:00
admin	20a77d367b	Data-loss hunt: R-1180 proven against production code (the nightly rsync --delete mirror runs while a restore holds the backup flag and deletes the files being restored)	2026-10-20 13:02:50 +02:00
admin	a57a8363df	Data-loss hunt: R-1191 (P1, proven live on 9202) — a .fab import makes a family-only app public (stranger 401 -> 200); R-1187 narrowed; register 169 -> 170; STATUS P1 line	2026-10-20 12:58:30 +02:00
admin	bffe2d9dea	Data-loss hunt 2026-10-20 C4: register 153 -> 169 (opened R-1175..R-1190: two P1 — shares second copy pruned by another drive's group, box rebuilt after the host delete cannot reach its off-site history; R-1177 proven LIVE on 9202 — a failed local restore destroys live data with no copy); STATUS: the P1 line and decisions D22, D23	2026-10-20 12:31:34 +02:00
admin	43e5a5496d	Data-loss hunt 2026-10-20: four reviewers' candidates, C2 verdicts, proofs (D1 shares second copy pruned, K1 escrow unreachable after host delete, R5 whole restore leaves app stopped while saying untouched, T9 hub jobs run twice on 25 Oct); rehearsal A5 manifest, B1 notes, B9 words, tools	2026-10-20 12:13:19 +02:00
admin	1d7071e8fd	Status view, part 3 (the gate): scripts/status_view_gate.py in repo_gates.py (fast: pre-push + CI) — size outside decide, one Updated paragraph, English outside quotes, cited rows open, no decided row in decide, the P1 and every operator-owned row on the page; WARN-FIRST until 2026-10-27, then it refuses; 39 decoy cases (red-proved per check and on both sides of the date); filed R-1174 (P4, Process & tooling) + its due check 2026-10-27; R-919 owner cell -> operator (the upload and the look); register 152 -> 153 ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-20 11:59:48 +02:00
admin	9ec5f76a88	Status view, part 2 (the page): STATUS.md rebuilt from the register — 107 lines / 31,695 bytes -> one screen (50 lines, about 5,400 characters outside the decide table); decide table: 8 open decisions (13 decided rows out, rulings checked in CLOSED-ITEMS); do list checked against the hub and DooPlex (7 done items out, 7 'still needed? yes/no'); old page byte for byte in STATUS-HISTORY.md ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-20 11:59:41 +02:00
admin	f84f94d987	Rehearsal 2026-10-20 (Tester4) + data-loss hunt: baselines, B1 install evidence, A6 drawn order, tools, first two reviewers' candidates ... No release, deploy or publish. Off-site is OFF for Tester4 and the owner passphrase is needed from the operator (bind blocked after 2 of 5 tries).	2026-10-20 11:57:55 +02:00
admin	2954b0be3a	Status view, part 1 (register pass): register 156 -> 152 (closed R-1121 file gone, R-1118 retirement done, R-231 in git + green run; R-993 merged into R-991); R-132 narrowed (rotation done, hash field left), R-1049 -> WATCHING (fix live since hub 0.151.0); hub + local read evidence ... Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-20 11:43:58 +02:00
admin	5c487313fa	Night brief part 2 (run by day 2026-10-20): register 160 -> 156 (closed R-1001, R-1011, R-1167, R-1070, R-1010, R-893, R-1169; opened R-1171..R-1173; R-1019/R-462 narrowed, R-49 READY -> D21, R-1083 re-stated); 07 §6.3 option A as the design; STATUS morning list; report part 2; P4 Immich plan, P7 release evidence	2026-10-20 11:06:00 +02:00
admin	bcaa9576b2	Night 2 evidence: P2 R-893 option A live proof on 9202 (forced failure put back exactly; normal restore OK; teardown); P5 R-462 coverage and currency list	2026-10-20 10:47:37 +02:00
admin	301f4e9e92	Night 2 (2026-10-20) evidence: P1 hub 0.162.0 deploy, installer 1.35.0 publish, agent 0.161.0 release+delivery+host_busy live; P2 R-893 red-proofs; P3 R-1019 classifier before/after	2026-10-20 09:32:53 +02:00
admin	7d7868e5e5	Night 2026-10-19 Part 10: ep0's first weekly prune matched the dry runs (only tester-1's 10-04 copy removed; every household has a rule) -> R-1162 closed, register 161 -> 160; R-895 and R-435 due dates moved 10-20 -> 10-21 with the reason; P10 evidence	2026-10-20 06:00:58 +02:00
admin	189eb82eb0	Night 2026-10-19: register 161 -> 161 (closed R-921, R-953, R-986; opened R-1168..R-1170; R-1001/R-1011/R-1010/R-1070/R-1167 READY, R-893 READY with the measured design note -> D20, R-1083 gap); morning list in STATUS; 03/05/07/11 updated; R-893 evidence	2026-10-19 21:44:10 +02:00
admin	f92fa5a8c8	nodes.md, nightly-rotation.md: scratch guest 9202 takes its address by DHCP (.114 until 2026-10-19, now .121); read it from the guest	2026-10-19 21:30:39 +02:00
admin	15f7428871	security_scan_gate.py: govulncheck (called vulns) + gitleaks on the pushed commits in every repo's fast set and CI, warn-first, with an accepted-hits file and 8 decoys (R-986); first scan triaged: 0 real secrets, 0 called vulnerabilities; evidence for R-953 and the 0.335.0 release	2026-10-19 21:03:23 +02:00
admin	a28f162c66	Day 3 2026-10-19: passphrase locks once the box uses its own key (D19; hub 0.161.0, controller 0.334.0 floor), every ep0 household gets a prune job (tenantsync v1.3.0), demo-hp address clean; register 163 -> 161 (closed 3, opened R-1167)	2026-10-19 16:34:29 +02:00
admin	224fe41e06	Day 2 2026-10-19: ep0 keep-weekly 2 (D18), passphrase measured (R-1159 READY, D19), hub 0.160.0 deployed, controller 0.333.0 floor, gofmt gates; register 167 -> 163 (closed 6, opened R-1165, R-1166)	2026-10-19 12:20:37 +02:00
admin	e2c35007b5	Website git-sync in-cluster: R-1163 closed with evidence, R-1164 opened (P4); report	2026-10-19 11:51:54 +02:00
admin	fd75003e17	webpage: the four git-syncs read Gitea in-cluster; sidecars retry forever (--max-failures=-1); gate 6 keeps the --repo values identical ... On 2026-10-19 09:24 the public path to Gitea failed once and the sidecar exited (max-failures defaults to 0). Anonymous in-cluster fetch proven first (main and installer-v1.34.0 resolve to the public hashes).	2026-10-19 11:38:44 +02:00
admin	db2371c6f5	Day 2026-10-19: agent 0.160.0 (released, not vouched), controller 0.332.0 floor (one sign-in R-1100, escrow confirm R-1151), hub 0.159.0 deployed (R-1150, R-1154), R-1153 not a defect, old-restic check passed; register 168 -> 166 (closed 10, opened R-1155..R-1162)	2026-10-19 05:38:38 +02:00
admin	200ab6530b	hub 0.159.0 to the manifest (operator yes in advance, 2026-10-19); P1 delivery evidence (agent 0.160.0 on all three hosts)	2026-10-19 04:10:23 +02:00
admin	5622ce2735	Day 2026-10-19 P1 evidence: agent 0.160.0 release, demo-hp delivery, backup + cap, escrow confirm/abandon, R-1093 on the format route	2026-10-19 03:52:34 +02:00
admin	afc939bb3c	R-887 closed: 381 CI jobs since the S21 change, 0 lost (the 3 re-runs' first attempts ran 47-49 s; control: the known lost attempt ran 11 m 48 s); register 168 -> 167	2026-10-19 03:42:11 +02:00
admin	b505ce4ba0	hub v0.159.0 (R-1154, after security review): the enroll reuse path re-issues nothing, it warns the operator ... The first draft (5121536f, unpushed) re-issued the claim code and the off-site login on a reuse whose old box was stale or switched off. A security review flagged it: the caller holds only the household's retrieval passphrase, and both re-issues are operator session-only actions (05 section 17.5, 09 decision 252, R-1055/R-1059). Now the reuse path classifies the old box and re-issues nothing: gone -> host_reinstall_over_old_host (warning, mailed to the operator: delete the old host and re-run, or re-issue by hand); live -> host_reenroll_while_live (info). The mint path after the operator's delete is unchanged and still re-issues. The once-per-silence record and the claim engine comment edit are reverted. 05 section 8, README and CHANGELOG updated; tests red-proved.	2026-10-19 03:29:44 +02:00
admin	5121536f10	hub v0.159.0: a refused whole-guest backup has its own alarm (R-1150); a reinstall re-issues the claim code and the off-site login when the old host is stale or off (R-1154) ... R-1150: the agent's localapi:backup-cadence-cap is a separate per-host state in HostCapabilityChecker: alone it raises whole_guest_backup_refused (warning, plain text, agent reason in details) and whole_guest_backup_refusal_cleared (info); other critical caps keep agent_capability_degraded/_recovered unchanged. New types operator-only and hub-origin only (not in allowedEventTypes: the suspected controller must not post them). agent_capability_degraded/_recovered join operatorOnlyEvents (the checker's "never the customer" claim was configuration only). R-1154: handleHostEnroll's reuse path re-issues (claim code + off-site login) when no controller wait is open and either deliberate_off_at is held or both the host report and the controller report are older than alerting.stale_threshold (wired from main); once per silence (host_reenroll_reissued record, also written at mint); a live box gets nothing re-issued and the skip is recorded (host_reenroll_not_reissued). 05 section 8 [DESIGN]. Tests red-proved; go build/vet/test green.	2026-10-19 03:18:34 +02:00
admin	e4f022a0d9	Evening 2026-10-18: fresh install proven (R-1148), OnlyOffice walk (R-1018), one-sign-in spike (R-1100 READY), Redis volumes (R-1117), CI rows, golden 0.331.0 baked; register 168 -> 168 (closed 6, opened R-1149..R-1154)	2026-10-18 23:12:21 +02:00
admin	7f7081d127	Day 2026-10-18: report, CONTEXT; old-restic check not run yet (demo-hp's clean-up window opens after the 2026-10-19 04:15 CEST run), STATUS time corrected ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-18 16:36:53 +02:00
admin	e881115c43	Day 2026-10-18: register (173 -> 168; closed R-1140 R-1144 R-1145 R-1146 R-1147 R-1036; opened R-1148), STATUS, agent 0.159.2 delivery evidence	2026-10-18 14:41:34 +02:00
admin	37cb83c166	Estimator: Immich peak 3,290 -> 3,983 MB from the 4,000-photo import (R-1147, operator yes 2026-10-18); Immich alone on 8 GB now 'does not fit' ... Rebuilt sizing-data.json; data cache-bust v5; SIZING.md table and the pinned test cases moved with it. Before/after: audits/day-2026-10-18/P6-before-after.md.	2026-10-18 14:36:14 +02:00
admin	624bcdc372	installer 1.34.0 (pushed; tag follows): vault-first step 4b (R-1145), --rotate-recovery-only (R-1141), harness gate (R-1146); R-895 dated check	2026-10-18 14:22:44 +02:00
admin	88aecf55b6	Installer step 4b: vault first, then set, then a PVE login (R-1145); host key off curl's argv (review F4); harness green and a gate (R-1146); hub 0.158.0 deploy evidence; independent review + verdicts ... Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0; the R1145 cases fail against HEAD. Publishes only with the next installer tag.	2026-10-18 12:50:49 +02:00
admin	070cea5bd1	Night 2026-10-18: register (175 -> 173; closed R-981 R-1142 R-1063 R-1069 R-1143 R-994; opened R-1144..R-1147), STATUS morning list, golden 0.329.0 record, evidence, report ... Golden 0.329.0 baked at the floor's version, NOT vouched. Hub 0.158.0 built, NOT deployed. Sunday rotation: no duplicate bake of an unvouched golden at the floor's version.	2026-10-17 23:56:53 +02:00
admin	7d64038f02	Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass ... Hub: the R-120 golden guard judges only a CHANGED golden selection; offsite_snapshots_vanished / _unexplained (operator-only, hub-origin) on the 07:10 listing; internal/accesslog writes path-only lines to /data/access-log, 90 days. Installer: --rotate-recovery-only runs step 4b alone (rides the next installer tag). 03: the orphan check runs after a failed backup (agent 6545ccc). 02: the allow-list is empty, appdata_folders (controller v0.329.0). All red-proofed.	2026-10-17 23:31:34 +02:00
admin	5a5486104a	Agent 0.159.1, the catalog allow-list (controller 0.328.0), break-glass rotation: report, register, design ... Closed R-971, R-954, R-1124, R-1012 (174 -> 175 rows); opened R-1139..R-1143; R-895 READY with the design and hub slice 1; R-972 waits on the vouch. [DESIGN] "The catalog allow-list" in 02; the catalog trust line in 01; FELHOM_THINCHECK and unit-forget in 03. Evidence audits/agent-allowlist-rotation-2026-10-17/. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 18:00:05 +02:00
admin	3feddadd2d	R-1133 closed as accepted (option A): ~/.docker/config.json joins the guard's read-refusal list (cc-secrets 0.2.2); 174 rows ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 16:30:25 +02:00
admin	8f97b8009b	hub v0.157.0: app_definition_refused (R-971), the vault time moves on a re-vault (R-954), the hub's own snapshot count (R-895 slice); uninstall knows felhom-thin-check ... - hub: `app_definition_refused` in allowedEventTypes + operatorOnlyEvents (controller v0.328.0's catalog allow-list refusal); SaveHostRecoveryCredential moves set_at on a re-vault (found live: both rotated hosts kept their first vault's time); the daily key audit also lists the box's restic snapshots/ read-only over the login the hub already holds and logs count/newest/oldest (no alarm yet). - installer (main only, rides the next tag): --uninstall removes /usr/local/sbin/felhom-thin-check (agent v0.159.0's bundle file); test_hostinstall.py knows it. - runbook whole-guest-backup-orphan-thin.md: the human repair the agent's new orphan finding points to. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:27:51 +02:00
admin	ab2fc21a9c	CC secrets: R-1138 closed (all old copies shredded, 175 rows); option B; sec run strips unloaded stored names; report ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 15:10:35 +02:00
admin	b29839ac68	R-1138: two dated credentials copies shredded; an undated third found, waits for the operator ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 14:58:42 +02:00
admin	d4ce52e1bb	Old ~/.config/credentials deleted on the operator's go (R-1134 closed); R-1130 accepted; R-1138 for its two backup copies (176 rows) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 14:40:49 +02:00
admin	e281de37c0	CC secrets STOP 3: R-1119, R-1120, R-1131, R-1132 closed (181 -> 177); R-1130/R-1133/R-1134 facts; new keys proven; report ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 14:21:11 +02:00
admin	f6511dc5c2	FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI mail: report, register, docs ... Closed R-1126, R-1125 and R-1129 (not a defect: a misreading of the CI log by the session that filed it); opened R-1135..R-1137; R-1124 noted. 01 §5 [DESIGN]: the tunnel runs before the claim; FileBrowser is published only after its default login is checked. STATUS D10-D12 decided. N100 diary: the 21-minute file-manager gap after 0.327.0. Controller 0.327.1 is the floor since 12:06 UTC. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 14:12:02 +02:00
admin	30b231f447	CC secrets build: register (177 -> 181: R-1130..R-1134 opened, R-1122 closed, R-1118 narrowed), STATUS D13-D16, report ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 13:42:14 +02:00
admin	ba40c0a25b	CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122) ... Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend: pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line. Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes, install, fresh-session proof, import names+lengths, history sweep names). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-17 13:33:07 +02:00