# STATUS — what works, what's broken, what's next

**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**

**Updated 2026-10-02. Both demo boxes run controller 0.287.0 and host agent 0.138.0. Hub 0.126.0. New installs get
golden 0.287.0 with agent 0.138.0.**

**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.

## Today: the family gate is built

- **What it is:** a door in front of chosen apps. Only the family gets in. Each family member has their own name and
  password. You add, reset and remove them on the dashboard: Settings → Security → **Család** card.
- **Grimmory (e-books) is published behind it.** Strangers cannot reach its login any more, so they cannot lock you out.
  E-readers (Kobo, KOReader, OPDS apps) still work with Grimmory's own login.
- **MeTube (video downloads) is published behind it.** It has no login of its own, so the gate is its only door. The page
  says: download only what you have the right to.
- **Measured on the scratch box and on demo-hp:** a stranger reached nothing; a stranger's wrong guesses locked only that
  stranger; a removed family member was out at the next click; backup, remove and restore kept the gate.
- **Phone test: skipped** — you were not here. A 2-minute test from your phone off wifi would prove the real-internet
  family sign-in by a person, not by me.

## Licences: all 58 apps read

Most are open source. These need your word (nothing was hidden or changed):

| App | The licence says | Choose: keep / hide / ask | I would |
|---|---|---|---|
| **Tandoor** | You may not sell a service whose value comes mostly from it (paid hosting and support named). | | ask the authors; keep meanwhile |
| **Emby** | Personal, non-commercial use only. Jellyfin does the same job. | | hide for new installs |
| **SparkyFitness** | Commercial use needs the author's written permission. (Decided: keep, ask.) | — | send the e-mail draft |
| n8n | Own or personal use is fine; giving it to others only free of charge. | | keep |
| Plex | Your household is the licensee with its own Plex account. | | keep |
| recipe-importer | Our own app — it has no licence file. | | pick one |

Four apps carry paid "enterprise" parts that stay switched off (Cal.com, Docmost, Outline, search in Wanderer), and seven
apps use Redis 7.4 as a private cache. Both are fine as they run; I watch them.

**SparkyFitness e-mail:** drafted, NOT sent. The author has no public e-mail; the draft suggests their Discord.
If no written permission arrives before the first paying customer, SparkyFitness gets hidden from new installs.

## Also today

- **A new golden (0.287.0).** Baked early, because a box from the old golden would have shown the two apps without the
  gate until its first update. The catalog check now refuses that case.
- **A bug in one catalog check, fixed:** the check "does the app keep its data where we back it up" never actually
  talked to any app. Fixed and proven; all apps must be checked again (my next work).
- **Rows.** 3 closed, 14 opened (most are your licence choices). The list went from 422 to 436 rows.

## What needs you

1. **The licence table above:** keep, hide or ask, per row. **If you say nothing:** everything stays offered.
2. **Send the SparkyFitness request** (the draft is ready). **If you do nothing:** it gets hidden before the first paying
   customer.
3. **Removing an app "with data" keeps its files** (Grimmory's books, MeTube's videos) in the household folder, and
   the dialog does not say so. **Choose:** keep them and say so on the dialog (I would), or delete the app's own folder
   too. **If you say nothing:** files stay, the dialog stays silent.
4. **Demo box apps:** I installed Grimmory and MeTube on demo-hp for the test and removed them after. Want them kept
   there for showing? **If you say nothing:** they stay removed.
5. **One phone test (2 minutes), only if you want it:** say so, and I put MeTube back on demo-hp and give you a family
   login; you open `video.enkisfelhom.hu` on your phone off wifi. **If you say nothing:** the proof stays my real-internet
   test from here.
6. Still open: Invidious and moonlight-web — I advise no to both. Pinchflat stays stopped (upstream paused).

## Standing steps

- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
- **Weekly:** the golden bake (next around 9 October; today's bake was 0.287.0).
- **SparkyFitness:** written permission from the author before the first paying customer, or `lifecycle: hidden`.
- **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.