4 Commits

Author	SHA1	Message	Date
admin	a08bd3cbd5	architecture: the system poster committed, its facts given a home, and a rule to keep them together ... PART A -- the poster. documentation/architecture/felhom-system-poster.html (307 KB). Secret scan first: ZERO IPv4, zero PEM blocks, zero ssh keys, zero Bearer. The one EAA... match is base64 inside an embedded "mime":"font/woff2" blob, not a Facebook token. "token"/"secret"/"password" appear 11 times and every one is a NAME ("6. ep0 read token", "the hub seal key"); the poster itself says "Names only; no secret values". All five long base64 blobs are declared assets: 1 image/png, 3 text/javascript, 1 font/woff2. It renders with NO network: the source mentions cdn.jsdelivr.net and Google Fonts, but the loaded requests are only the HTML plus blob:/data: URLs -- the bundler inlined everything. Measured, not assumed, and it matters: this is a disaster-recovery document, so needing the internet to draw would be a defect. No console errors. The operator's three Claude Design fixes are all present: (a) no "WG" badge, WireGuard only for the tunnel, no badge on the ep0-copy tile; (b) the box -> ep0 arrow reads "encrypted on the box, sent through WireGuard"; (c) "Known gaps" holds two items and NOT the household-keys sentence, which is now a neutral "By design" note under the ep0 household namespace. ONE FACT ON IT WAS WRONG. The felhom.eu tile said "served from DooPlex through Cloudflare". It is not: Cloudflare is DNS only and the traffic goes direct -- measured this morning for the privacy notice, which states exactly that. The poster would have contradicted a published page. Fixed in place (a label): "served from DooPlex, Cloudflare DNS only". The first wording overflowed the fixed-size tile, so it was shortened to fit and the evidence lives in the facts file instead -- checked by re-rendering, not by hoping. PART B -- the facts and the rule. DESIGN-PROMPT-...md is renamed felhom-system-poster.facts.md (one home per fact), with the three fixes folded in as explicit instructions so a regeneration cannot undo them, plus a new "Badges" section saying a "WG" chip must never come back. New rule, section 6 "The system poster stays true", added IDENTICALLY to all five copies of unprompted-work.md (the four repos and the workspace root on DooPlex; verified identical by diff before and after) and to PROMPT-TEMPLATE.md's end-of-session checklist as a FIFTH coupled artifact. scripts/poster_facts_gate.py WARNS when the facts file has a newer commit than the poster. It never fails a push, deliberately: a refresh needs Claude Design and the operator, --no-verify is forbidden here, so a blocking gate would leave deleting it as the only way out. It compares COMMIT times, not mtimes, because a checkout rewrites mtimes and every fresh clone would shout. RED-PROOF -- and it found a real bug in the gate. The first run warned correctly but exited 1: a single non-ASCII character in its own warning raised UnicodeEncodeError on this cp1250 console. A gate whose entire contract is "never fails a push" was failing pushes. Fixed (ASCII output + an encode guard), and the decoy now asserts BOTH the warning and exit 0. Three branches proven: facts newer -> warns, rc 0; poster newer -> quiet, rc 0; poster missing -> "could not tell", rc 2, not a false all-clear. The decoy itself was seen to fail, twice, on Linux (the suite needs fcntl and cannot run on Windows): breaking the warning gives STALE_WARNS=False, and making it exit 1 gives RC_STALE=1. All 80 felhom.eu decoys behave. PART C -- do box reports pass through Cloudflare? NO. Two channels. DNS from PUBLIC resolvers (not DooPlex's own, which answers the LAN address): hub.felhom.eu is a CNAME to dooplex.hopto.org -> 37.191.56.193, not a Cloudflare address, and no cf-ray comes back. The manifest: an ordinary k3s Ingress, Cloudflare named only in a DNS setup comment. THE CONTROL that makes the negative mean something: iso.felhom.eu resolves to 172.67.x / 104.21.x, real Cloudflare addresses -- so the method does detect proxying. So nothing is added to the Cloudflare row: the hub path does not touch it. 06-offsite-connectivity.md section 1 claimed the public edge is a Cloudflare-Tunnel and "DooPlex has no public IP" -- both untrue today. Kept and marked STALE with the measurement rather than rewritten, because that paragraph is the reason ep0 exists and the argument needs its premise visible. total-loss-of-dooplex.md's "today a CNAME to dooplex.hopto.org" is confirmed correct. Register: 137 before, 137 after, 0 opened, 0 closed -- every finding here was small and fixed in the session.	2026-10-09 18:09:50 +02:00
admin	3885640f66	docs: rulings 2026-10-04 (decisions 75-77); add 11-os-updates.md verbatim (NOT RATIFIED) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-04 08:42:38 +02:00
admin	6088afcbed	Verify the standing picture against source: 12 downgrades, and the decay ran both ways ... 55 claims verified. Twelve moved, all downwards: walked 32 -> 20, built 5 -> 17. Register ceiling R-284 -> R-290. THE RULE DID NOT FIRE THE WAY IT WAS EXPECTED TO. Not one downgrade came from code moving under an old proof. All twelve came from step 1 of the same rule -- the cited evidence does not exist. Measured: of the 28 capability-map rows behind the page's claims, 8 carry a tests/ or audits/ path and 20 carry prose only. The green dots were drawn from rows that cite an argument, not a walk (R-290). The map, not the dataset, is what needs fixing -- it still says PROVEN-LIVE for all twelve. And once it ran backwards: fault.operator-email looked contradicted by R-182, but live source shows the backup_run_failures digest allowlisted, operator-only and templated, with recovery_unit_capture_failed now record-only. The claim is right and the REGISTER ROW is stale (R-289). The session went looking for stale proofs and found a stale defect. R-281 WITHDRAWN -- wrong in both directions, settled by the operator's mailbox. The tripwire DID fire (escrow_blob_served 10:19:41Z = 12:19 CEST) and false error-severity alarms fired too, for deliberate attended work (R-285). The measurement's cause is ESTABLISHED: the P7 query copied hub.db without hub.db-wal, and the signature is exact -- it reported "2 events all day, newest 00:30:07", and the rows at or before 00:30:07 number exactly 2. Timezone and wrong-key were tested and refuted. The control had been drawn from the same stale snapshot as the measurement, which is why it agreed (R-286). Part 4: NO WORKFLOW CHANGED, deliberately. The gate is not ref-sensitive -- it enumerates from the Gitea tags API, and both previous tag pushes passed. The red is TRUE: run 267 saw v0.120.0 downloadable, run 284 on the same commit saw 404. Who deleted the package is NOT established and is not guessed (R-287). The page is now generated from where-felhom-stands.yaml by scripts/render_stands.py: static, zero script tags, every moved status carrying a visible "changed, was X" chip. The React bundle -- whose content was gzip+base64 inside a JS module map -- is kept as a dated snapshot. scripts/check_stands.py gates the data and convicted 51 problems in my own first draft before the staged positive control ever ran.	2026-08-09 18:40:49 +02:00
admin	21d0e7cf4c	docs: centralize controller documentation + top-level index (code-verified, v0.59.0) ... New documentation/controller/ subtree (module map + deploy/stack-lifecycle, backup, storage/monitoring/metrics, auth/hub/sync/integrations) grounded in current source; top-level documentation/README.md index across controller/agent/platform/hub/audits; REORG-NOTES with the verification ledger + flagged doc-gaps. Supersedes (keeps) the v0.33 controller planning map. Additive only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 19:40:25 +02:00