5 Commits

Author	SHA1	Message	Date
admin	3159892fab	Both rulings built: same-tag re-tests (decision 52), image retention + the install hold (controller 0.284.2); golden 0.284.2 ... - Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202 through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today. - Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored — two wiring faults found live on 9202); floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger. - Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK. - Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446. - register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red. Evidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/. Report: REPORT-night-rulings-2026-09-30.md. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-30 23:26:21 +02:00
admin	462ab4a5ff	Part 0: repair the register, gate its shape, and record Hetzner's answers (R-627, R-628, R-629) ... THE REPAIR. Last night's append regex ate the state cells of R-446 and R-458, left them as a stray fourth cell on duplicated copies of R-626 and R-625, and split the table with blank lines. The register read 317 rows for 315 findings. Both cells restored from the cells that carried them, the two duplicates deleted, and 15 blank lines that split the register into 12 separate markdown tables removed. Every row's text is byte-identical afterwards, proven by diff; no row added or removed. THE RED-PROOF FOUND AN OLDER INSTANCE: R-254 lost its state cell on 2026-08-08 (59527d0) and had rendered without a State column for 45 days. Its own verdict sentence was the cell; it has it back. THE GATE. scripts/register_shape_gate.py, gate 14 in repo_gates.py and reached by the pre-push hook: a row that does not end with `|` (an eaten state cell), a duplicated id, or a blank line splitting the table. Four decoys in test_gate_decoys.py — three convicting on the exact damage shapes, one asserting a healthy register still passes. The red-proof corrected the gate twice: a first draft counted CELLS and convicted 125 innocent rows (register cells carry literal `|` in prose and shell snippets, so a row cannot be split on `|`), and it skipped malformed rows before counting ids, reporting 5 duplicates where there were 2. It then immediately caught a blank line left by this session's own next insert. R-618's rank now reads P1-HIGH in both its title and its state cell. HETZNER ANSWERED, AND I FIRST SAID THEY HAD NOT. The operator supplied ticket #2026090103040671. Q1: with the MAIN account, files and directories can be downloaded from a snapshot (Storage Box docs govern, not the Storage Share FAQ); a restore reverts the whole box. Q2: --append-only is enforced by pinning `command="rclone serve restic --stdio --append-only path/to/repo"` to the key in authorized_keys — so append-only IS expressible on a Storage Box, which is what R-95 was blocked on. Neither is measured; R-436's due check now asks for the measurement, not the question. My error is filed as R-628 and is precise: the query was fine — a control returns 201 threads and reaches SENT and TRASH — and the thread genuinely is not in this mailbox. What was invented was the step from "absent here" to "Hetzner has not answered". An absent record in one place cannot answer what someone else did. The rule is now in the Gmail-access memory. R-629: the drill repo inherited has_actions from the migrate call and mailed the operator 47 CI failures overnight, into the mailbox that was carrying real off-site alarms. Actions disabled and verified; 09 §6.5 now makes it a step of creating a drill repo. The 47 mails are the operator's to clear: subject:"gates FAILED in admin/app-catalog-drill". Gates: repo_gates.py --fast — all 16 OK, including the new one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-22 10:22:37 +02:00
admin	e02bc03819	hub v0.119.0 — English households get English words for their codes (R-597); R-596/R-598 closed ... The setup code and the owner passphrase now follow the household's language, one word longer in English so the entropy never drops (setup 3 hu / 4 en, passphrase 5 hu / 6 en). List and count are chosen together so a caller cannot pair an English list with a Hungarian count. Hungarian is byte-unchanged. Three claims in the row were wrong and are recorded as such: - the RECOVERY CODE is minted by felhom-agent from the EFF list and has always been English; the hub does not own it and no row was added. - no claim mail states a word count; the only count wording was the bind page's passphrase hint, whose English half is now count-free. - the proposed phone-safe filter removes 68% of the list (5270 of 7772 words) and was measured, then declined, with the reason in source. Also: guide_quote_gate binds the English volunteer guide's three quoted messages to the controller's English bundle — nothing did, so the guide would have gone on quoting Hungarian after the fix. Seven decoys, all convicting, including the name-for-fact one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-21 07:56:56 +02:00
admin	9167cf53af	hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A) ... The hub has written every customer e-mail in Hungarian whatever the box was set to. The box has published its language since controller v0.247.0; nothing read it. Now it does. Nothing an operator reads changes. The Hungarian mails are byte-identical, and that is a diff rather than a reading: 56 goldens per language captured from v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after every sentence was routed through the new bundle. - internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0. - customerMessages/severityLabels are DERIVED from the bundle, so a sentence is written in one place and all 40+ tests that read those maps still work. - Language order: last reported -> created-with -> hu. reports.language defaults to EMPTY, never hu: "never told us" is not "chose Hungarian". - message_customer on POST /api/v1/event, additive and optional forever, for the sentences the box composes and the hub cannot translate. - The bind page is per-language, and its `expired` state stays Hungarian: it is the state an unknown token lands in, so rendering a real English customer's token in English would make the LANGUAGE answer what the TEXT refuses to. Two defects found inside the release: - R-581: the newest report was picked by received_at, which has SECOND granularity, so same-second reports tied and the winner was arbitrary. Ordered by the autoincrement id now. GetCustomers() still has the shape - row open. - R-582: the English copy-guard stems, ported word for word from Hungarian, convicted 141 honest sentences. The English claim is a phrase with a modal. R-555 closed: the language allowlist entry is out of wire_contract_gate.py. hub_copy_gate.py follows the sentences into the bundle - without that it would have scanned four files that no longer hold any customer text and reported success. Three new decoys incl. an innocent control. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-18 16:20:11 +02:00
admin	574f5df107	the decoy sweep: 29 gates read, 16 fooled, 10 fixed - and a gate that refuses the next one (R-421) ... THE CLASS, now a row: an instrument that matches a LABEL rather than the fact it names. Five instances - R-410, R-400, R-378, R-419, R-94 - and EVERY ONE was found by accident, by someone looking at something else. The gates enforce every other rule in this project, including the rule that findings must be written down rather than left in prose. Nothing had ever checked the gates. METHOD, and it is the transferable part: for each gate, construct the label WITHOUT the fact - a directory with the right name and no bake log, a handler case that exists only in a comment, a note whose prose mentions the marker it lacks - run the gate, record what it says. No verdict was reached by reading. Reading is how all five hid. RESULT: 29 distinct scripts (35 registrations; three are shared across three runners). 19 sound, 4 holes left OPEN with rows, 6 that no plausible decoy could be built for and are named UNTESTED rather than called sound. A gate nobody tried to fool is UNKNOWN. SCOPE IS A FACT TOO - the largest single cause, and mundane. Eight gates decided what to look at with os.listdir, one level. Every one was green AND CORRECT today, and every one would have gone blind the moment anyone added a subdirectory. mojibake and docker-v already used os.walk, caught the identical planted file, and are the control that proves the cause was the listing and not the decoy. IN THIS REPO: hub-confirm and manifest-bearer now walk. observations_gate (R-419, CLOSED) requires a marker at a line start or after a sentence boundary and strips inline code spans - a note SAYING it carries no marker no longer satisfies the marker test. closed-register now CONVICTS on a row it cannot parse instead of warning: FOUR rows were in that state, TWO of them written by the session that closed them the day before, and every one was exempt from the only check that reads that file. The rows were repaired first and the conviction added second - registering a failing gate refuses every push. THE META-GATE: decoy_coverage_gate.py refuses a gate registered without a decoy or a named exemption. It convicted ITSELF the moment it was registered, which is how it came to have one. Coverage is a DECLARATION the gate AST-parses, never a grep - searching a test file for a gate's name would be the very shape this sweep exists to find. The 20 uncovered gates are listed by name (R-426). NOT FIXED, each with a row and a decoy asserting TODAY's behaviour so the fix must be deliberate: R-422 reuse-refs (only 7 extensions; a rotted .md citation is invisible), R-423 site (PAGES is a hardcoded list of 7), R-424 one-register (a defect parked as `idea`), R-425 offbox-rename (fixed FILES list). R-427: closed_register_gate checks ONE direction - twelve open rows carry a closed verdict and were NOT moved, because telling finished from partly-finished is a judgement and R-378 is the record of a machine getting it wrong. FIVE DECOYS WITHDRAWN AS ILLEGITIMATE, mine, named in the audit. A decoy nobody would write proves nothing, and manufacturing a finding to fill a row is worse than an honest NO. No product code. No version bump. No image. No golden owed. All four runners green. Register: OPEN 172 -> 178, CLOSED 160 -> 161.	2026-09-01 12:39:45 +02:00