878 Commits

Author	SHA1	Message	Date
admin	5277d859d5	hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189) ... The Cloudflare tunnel token, Cloudflare API token and git token inside customer_configs.config_json now hold the 05 §16.2 seal (enc:v1:, OFFSITE_SECRET_KEY). Old rows sealed once at start-up without a config_version bump, then VACUUM + WAL checkpoint (an UPDATE leaves the old plaintext in a freed block). -unseal-box-secrets opens them too. Eight tests, each red-proved. Built, not deployed. Audit: documentation/audits/hub-token-seal-2026-10-23/.	2026-10-23 19:48:17 +02:00
admin	8257ff1cbe	Plex2Shell impact on Felhom: verdict NOT REACHED; R-1241 (P1), R-1242 (P3) opened (register 186 -> 188) ... Read-only audit of whether the hacked Plex pod on DooPlex (HM-040, 2026-10-17 -> 10-23) reached Felhom's secrets. Two no-login doors existed (the Longhorn NFS export and the Longhorn API); neither was used: nfsd accepted 0 new connections in the window (positive control), no off-schedule Longhorn backup or volume. Evidence in documentation/audits/plex2shell-felhom-impact-2026-10-23/. The NFS export was narrowed from * to 10.42.0.0/16 on the operator's yes (host change, not in git). 13-threat-model.md: attacker j and one boundary row. STATUS: verdict, the P1, one do item.	2026-10-23 17:53:43 +02:00
admin	87dc50743c	D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:35:38 +02:00
admin	4b9b0af3cb	Plex2Shell: the operator's 10:56 ruling in CONTEXT; demo-hp 9201 checked (clean) and updated to 1.43.5.11029; register 184 -> 186 (opened R-1238 Plex test record/fixture, R-1239 a fast lane for security fixes = D39); evidence plex-demo-boxes-2026-10-23 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 11:27:52 +02:00
admin	2c9152d912	Day 2026-10-23 close-out: rulings D31-D36 in CONTEXT; STATUS (releases done, do list, D35 dated, D37/D38); register 191 -> 184 (closed R-49 R-982 R-985 R-991 R-1204 R-1205 R-1225 R-1226 R-1227 R-1230 R-1234; opened R-1235 R-1236 R-1237); the break-glass sheet current (D32, one A4, HU+EN); runbooks for D33/D34; poster facts; evidence day-2026-10-23	2026-10-23 11:03:45 +02:00
admin	a408256c7e	REPORT-night-2026-10-23: the night report (five lines, parts 1-5, findings -> verdicts, the test night PASS, teardown in three layers, commits + CI); STATUS: the test night's verdict in the morning list; Nextcloud sha256 + teardown evidence	2026-10-23 07:39:27 +02:00
admin	1cb3e57133	Register 189 -> 191 (R-1232 a reinstalled box's first ep0 copy may come a week late — likely; R-1233 an error line naming nothing); test-night evidence: night jobs, D21 on the box, no copy container left, off-site leg/proof/integrity, controller log, agent journal (sudo noise trimmed), recorder, outside probe, loader logs, Immich per-user counts, night numbers	2026-10-23 07:13:52 +02:00
admin	5dc17cab03	test night: controller fixture 2 (rc.8) recorded	2026-10-23 00:07:06 +02:00
admin	f56f3328f7	Register 187 -> 189: R-1230 (a held box reported stuck — measured on the test night, fixed in hub 0.167.0 source), R-1231 (the recovery page calls an unknown agent older); test-night provenance	2026-10-23 00:07:01 +02:00
admin	e94d0256d2	test night evidence: agent fixture 2 (0.162.99 = agent main b9b831f), the off-site unlock with the household's recovery code (first refused: a pre-release fixture version reads as an unknown capability)	2026-10-22 23:56:34 +02:00
admin	70a600d0c2	Register 180 -> 187 (opened R-1223..R-1229: the tunnel reboot gap, the per-customer cooldown, two website sentences, the registry and the home line and ArgoCD from the DooPlex survey); R-1214/R-1204/R-1205 READY, R-1187/R-982/R-925/R-232/R-923/R-924 updated; rc.8 re-proof of the stray-copy fix on 9202	2026-10-22 23:25:16 +02:00
admin	7585443227	night 2026-10-23 so far: D30 live proof (re-key → new-key handshake; ep0-started handshakes heal a short clock jump by themselves), D4 patches v2 after review, test-night install/fixture evidence, DooPlex survival survey (read only) + PLAN, 03/05/07 + CONTEXT, total-loss runbook: MAIL-HOLD shipped	2026-10-22 22:24:48 +02:00
admin	84751cb0ce	hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence	2026-10-22 21:04:42 +02:00
admin	acc78637d9	night 2026-10-22: the seven 15:47 rulings in effect or ready (D6, D8 live; D21 waits for controller 0.340.0; D3/D5 website patch; D4 two patches); data-loss candidates proven/fixed/filed; R-1214 cause + capped copy proven on 9202; R-1204 alarm built; repos-private read; STATUS morning list + D29/D30/D31; CONTEXT; 03/05/07/09; rows 178 -> 180 (opened R-1218..R-1222, closed R-206, R-992, R-1207)	2026-10-22 18:24:30 +02:00
admin	1100a344d5	night 2026-10-22: D4 as two ready patches (agent bundle + installer uninstall) — a push of the installer would publish it	2026-10-22 17:11:07 +02:00
admin	e267c5e2cd	hub 0.166.0 source: the clock-ahead tunnel alarm wg_tunnel_stale/ok (R-1204, operator-only, edge-triggered); D21 + D4 proof evidence	2026-10-22 17:02:37 +02:00
admin	0639cf0772	night 2026-10-22: D3 wording in the volunteer guides (the website change is a ready patch — a push publishes); D6 drill-reader proof; P3 research; P6 repos-private readers (read only)	2026-10-22 16:22:28 +02:00
admin	1b442bcc2e	Tester 2's RESET checked read only: every leg ok, the first live R-32 purge (folder held no repository; sub-account gone), ep0 namespace+copy+prune job+token gone, no other customer touched (Storage Box 303/62/43 and ep0 2/2/2/1/27 before = after); hand-over: tell the friend go; A20 third firing; R-32 result + dated check for Tester4	2026-10-22 15:04:07 +02:00
admin	ecfc09c3ef	day 2026-10-22: R-1199 reopened and closed (hub 0.165.0 + controller 0.339.0; demo-felhom's list restored), R-1216 closed (D28 = A), R-1217 filed; Tester 2 hand-over list; STATUS, CONTEXT, D28 to history; rows 178 -> 178	2026-10-22 13:17:17 +02:00
admin	115f15c89e	morning 2026-10-22 evidence: agent 0.162.0 delivered to the 3 test boxes, controller 0.338.0 on all 3 through the floor, https-only + containers + controller errors green	2026-10-22 10:16:49 +02:00
admin	26dbc987d9	night 2026-10-21: soak result (no freeze in 11 h; memory pressure above 20 % for 3 min in the tier2 job, R-1214; 1 Immich upload lost, R-1215), no-swap test (the freeze comes back without host swap, R-1207), teardown, the night report ... Rows 182 -> 184. STATUS morning list item 2 carries the soak result; CONTEXT the two results.	2026-10-22 06:50:29 +02:00
admin	97f088ec02	night evidence: both Nextcloud upload trees 3031/3033 byte-identical against the night manifest (the 2 missing are the uploader's by-design skips)	2026-10-22 01:12:36 +02:00
admin	57c06ba99d	CONTEXT + 08: tonight's rulings (D22, D26) and the CC-unattended R-1199 decision (the box's page is the list the hub mails by); evidence: rc.2 smoke on 9202, 9202 back as found, no-swap test tools	2026-10-21 23:45:05 +02:00
admin	2293b252d5	docs: 07 §6.3 the put-back covers every restore and a power cut (D22, as built and proven on 9202); 03 guest swap = RAM and the host's swap behind it; capability map D16; soak provenance	2026-10-21 23:00:45 +02:00
admin	6b0d23c29c	night 2026-10-21 evidence so far: soak box install + fixture agent (swap raised live), D22 proof on 9202 (put-back on a damaged unit and after a controller kill), R-1194 reproduced, R-1199 read, red-proofs, the W2 website patch (not applied)	2026-10-21 22:39:25 +02:00
admin	dbfe5dac06	fixes 2026-10-21: teardown (demo-hp, hub, ep0 read-only), final evidence	2026-10-21 18:50:23 +02:00
admin	47fa1e621e	fixes 2026-10-21: register (7 closed, R-1205/R-1206 opened, R-1183 VERIFY, R-1192 diagnosed), STATUS (not ready: one step — the agent swap fix), A12/A13 proven live, CONTEXT, report, evidence	2026-10-21 17:57:32 +02:00
admin	ef4dbcf984	fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)	2026-10-21 16:00:36 +02:00
admin	e07b077ac2	system poster refreshed 2026-10-21: one-file HTML + A1 PDF from Claude Design (data area, https only); R-1201 closed ... Third export passed all Part A checks (documentation/audits/poster-refresh-2026-10-21/CHECKS.md). STATUS poster line removed; facts file History line. Register 179 -> 178. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-21 13:25:43 +02:00
admin	7ad17be6bd	rehearsal 2026-10-20: final report, STATUS (morning list, D24), capability map A12/A13 → PARTIAL (B7), stuck point 10	2026-10-21 11:47:40 +02:00
admin	eaff4d890c	teardown: secret count 24	2026-10-21 11:41:58 +02:00
admin	7a287e71fc	rehearsal 2026-10-20: Part D teardown (machine done; hub host for the operator; ep0/Storage Box listed, nothing removed)	2026-10-21 11:41:51 +02:00
admin	6559aa6d2e	rehearsal 2026-10-20: B7 — re-linked after the operator's press; the household cannot restore from off-site (R-1176 proven live)	2026-10-21 11:36:48 +02:00
admin	a2d2569719	register: the ep0 WireGuard row is R-1204 (R-1201 was taken by a parallel session; the earlier commit message says R-1201)	2026-10-21 11:03:32 +02:00
admin	ebf142d921	rehearsal 2026-10-20: B7 — box destroyed, reinstalled; the forgotten press is a dead end for the household (R-1203, P2)	2026-10-21 10:59:24 +02:00
admin	6d73110cd0	rehearsal 2026-10-20: B6 #10 + #15 — PASS	2026-10-21 10:59:24 +02:00
admin	ff06ab52da	rehearsal 2026-10-20: B6 #8 wrong clock — R-1201 (ep0 tunnel dead after a clock ahead, P2), R-1202 (clock behind: silent app stop, blames the hub)	2026-10-21 10:59:24 +02:00
admin	a3be7525cd	rehearsal 2026-10-20: B6 #7 DST live — PASS (one database copy at the second 02:30); #8/#10 expectations written before	2026-10-21 10:59:24 +02:00
admin	3decdf94a8	poster refresh 2026-10-21: export NOT taken in (6-file folder, 4 unasked text rewrites -> R-1201); OMV guide matches Ferenc's PDF (installer >= 1.33.0) ... Part A checks + label diff + PNG crops in documentation/audits/poster-refresh-2026-10-21/. Guide: HDD_PATH trouble item and "remote data area" sentence removed, first-days line added, operator note dated. Register 178 -> 179. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-21 10:00:54 +02:00
admin	31d975c997	rehearsal 2026-10-20: B5 night (db/second drive/off-site PASS, data identical; whole-box not due → R-1200; host reboot = harness); due checks R-1019 closed, R-895 read, R-435 moved	2026-10-21 07:38:10 +02:00
admin	0d3f72e463	rehearsal 2026-10-20: journal — push held by due-checks gate	2026-10-21 02:58:05 +02:00
admin	c4262a6f6c	rehearsal 2026-10-20: night db copy OK; watcher logs recovered after an autostash froze them (harness slip)	2026-10-21 02:44:16 +02:00
admin	a600d68d50	rehearsal 2026-10-20: night log copier added before the night (read-only)	2026-10-20 23:39:50 +02:00
admin	830ed9714e	rehearsal 2026-10-20: report draft (night/morning parts pending); W26 marked fixed (unreleased)	2026-10-20 23:27:47 +02:00
admin	16188df64c	rehearsal 2026-10-20: 44 more screenshots off the browser container, gallery rebuilt; A4 browser spike result	2026-10-20 23:16:20 +02:00
admin	0d4bfe7ca6	rehearsal 2026-10-20: pre-night household snapshot (byte compare vs manifest), B7 plan written before	2026-10-20 23:09:29 +02:00
admin	938afb7416	rehearsal 2026-10-20: B10 ten stuck points; capability map A15 updated (still PARTIAL: R-1192); clock tool for #7/#8/#10	2026-10-20 22:41:46 +02:00
admin	c0b70b15ac	rehearsal 2026-10-20: post-night scenario plan written before any result	2026-10-20 22:24:21 +02:00
admin	ce8cf2c477	rehearsal 2026-10-20: B6 #1 README, journal to 20:14, B5 night expectations written before the night	2026-10-20 22:18:53 +02:00
admin	4a557f54a5	rehearsal 2026-10-20: B6 #1 power cut mid install, #6 off-site blocked, #14 kept data — evidence	2026-10-20 22:13:50 +02:00