# REPORT — second day brief, 2026-10-19 (ep0 one copy per week; the passphrase measured; hub 0.160.0; controller 0.333.0; gofmt gates)

## In plain words

- **ep0 keeps one whole-box copy per week, for 2 weeks** (your „yes"). Before the change, PBS's own dry run showed it
  removes nothing today. The first real run is 2026-10-20 03:30 UTC; CC reads it then (row R-1162 stays open until then).
- **The household passphrase:** alone it gets the box's keys, and with them every off-site key action. Two options are
  in STATUS (D19). CC picks A: the passphrase gives keys only while the customer has no box record.
- **Controller 0.333.0 is the floor for every box** (12:16 local): a dashboard sign-out now also ends the file manager's
  own 2-hour pass; the recovery-code page says the code becomes live after the two words.
- **Hub 0.160.0 is live** (your „yes"): a reinstall within 45 minutes mails you too; a repeated refused backup is counted
  and the alarm repeats at most once a day; the old off-site re-issue on a reinstall is kept, with true words.
- **gofmt:** the hub and the agent are formatted, and both now have the controller's gate.
- **New for you:** another device keeps taking demo-hp's network address (R-1166) — fix it in the router.

## 1. ep0 (R-1162; `07` Plane-2 row and §6.1)

- **Before** (`audits/day-2026-10-19b/P1/ep0-settings-before.txt`): `prune-demo-hp` and `prune-demo-felhom` —
  `keep-last 2`, 03:30, ns-scoped, `max-depth 0`; `prune-operator-hubdb` — keep-daily 14 + keep-weekly 8, 03:45.
  `tester-1` (3 copies) and `Tester-2` (1) have **no job**. ep0's clock is UTC.
- **DooPlex's copy of ep0:** `prune-ep0-copy`, `keep-weekly 8`, 07:30 (decision 71) — already by time; not changed.
- **Dry run** (PBS's own: `proxmox-backup-debug api create /admin/datastore/felhom-offsite/prune --dry-run true …`, no
  task created; cross-checked with an offline model of PBS's selection, `P1/prune_sim.py`; 8 snapshots before and after):

  | Box | Snapshots | keep-last 2 removes | keep-weekly 2 keeps | keep-weekly 2 removes |
  |---|---|---|---|---|
  | demo-hp | 2 | none | 2026-10-08, 2026-10-15 | none |
  | demo-felhom | 2 | none | 2026-10-06, 2026-10-13 | none |
  | tester-1 (no job) | 3 | (2026-10-04) | 2026-10-11, 2026-10-18 | (2026-10-04) |
  | Tester-2 (no job) | 1 | none | 2026-10-04 | none |

- **Answer:** „Yes, the two rules" (not the tester-1 job). **After** (07:49 UTC, `P1/ep0-settings-after.txt`): both jobs
  `keep-weekly 2`, schedule 03:30 unchanged, nothing run by hand. Check for 2026-10-20: the 03:30 `prunejob` tasks OK with
  `keep-weekly 2` and two snapshots per namespace (the next step of R-1162).

## 2. The household passphrase (R-1159)

Measured with the hub's real router (`P2/passphrase-reach.txt`; a made-up customer, a fake off-site service). A live
measurement on Tester4 was not possible: CC holds no Tester4 passphrase, and reading it from the hub database was
refused by CC's own safety check (correctly).

- Passphrase → `GET /config/{id}` 200 with `hub.api_key` (wrong passphrase 401); `POST /host-enroll` 200 with the
  EXISTING host's key.
- Controller key → `register-key`, `confirm-key` (removes every other line, the box's own key included), `move-aside`,
  `window-open`, `abandon-request` (the hub deletes a set-aside copy after 7 days unless cancelled), `abandon-cancel`,
  `abandon-status`: all past auth (wrong key 401 each).
- Host key → escrow GET/PUT, recovery-credential PUT, wg, desired-state, jobs, host-report: all past auth.
- The passphrase is used only at install time (the installer, the controller's setup wizard).
- **Option A (CC's pick):** keys only while the customer has no host record (`/config` leaves out the key, `/host-enroll`
  refuses once a host exists). Closes the chain at its source; a reinstall needs the operator's delete first — already the
  rule since R-1154. **Option B:** a second factor on the destructive off-site routes. Every reinstall waits for the
  operator, and the host key stays reachable by the passphrase, so B alone does not close it. No change in this task.

## 3. Controller 0.333.0 — R-1155, R-1161, the Install chip

- **R-1155:** first measured on demo-hp (0.332.0): the household's FileBrowser token opened FileBrowser after the
  dashboard sign-out (200, cookie and Bearer). Fix: the forwardAuth answer refuses a request with no valid files cookie
  that carries a non-admin FileBrowser token, everywhere FileBrowser reads one (cookie, `?auth=`, Bearer, Basic
  password). **The commit's security review found Basic missing** in the first version (`c809dd3`); fixed in `a6fa3c0`
  before any release. Red-proofs: without the check → 200 after the sign-out; without the Basic branch → 200; with every
  token refused → admin's own token 302. Live (rc.2 demo-hp, 0.333.0 Tester 1): files cookie 200; token alone 401 in all
  four forms, before and after the sign-out; FileBrowser's sign-in page 200.
- **R-1161:** new key `backups_escrow.ez_a_kod_az_ellenorzes` (hu + en); the old sentence only when the claim answer says
  no confirm. Fixtures re-captured: `escrow_first`, `escrow_receremony` (reason: R-1151 made the old sentence untrue);
  all others byte-identical. Live on demo-hp (`P6/06-escrow-page-text.txt`): new text shown, old hidden, switch present,
  negative control 0.
- **The Chrome „Install" chip: NOT-A-FINDING.** FileBrowser 1.5.6 links `/public/static/site.webmanifest` on every page;
  its only PWA setting is `disablePWAInstall` (already set). Not patched (`P3/install-chip.txt`).

## 4. Hub 0.160.0

- **R-1156:** a live re-enroll is a warning mailed to the operator, same instruction; a `--resume` mails too and says it
  needs nothing. **R-1157:** further refusals in one episode counted (`refusals_in_episode`), alarm at most once a day,
  total on the cleared record. **R-1158:** the reinstall's off-site re-issue changes nothing a box uses (only the hub's
  own registrar reads that password; no box has received it since v0.127.0); kept because it repairs a broken stored
  login; comments and the `offsite_reissued` text corrected (`05` §8). Each red-proved.
- **Answer:** „Yes, deploy now". Image `0.160.0` digest `sha256:e9a360bc00d00a15014e272c4d023fef118a8b043956f3fc928dd26c00b34230`
  (clean clone at `a17db0c3`; the first push hit a DNS timeout, the retry pushed it). Manifest `5d3cb5c1`; only
  Deployment/hub was OutOfSync and only it was synced; Synced/Healthy; running image digest = built digest; 0 `[ERROR]`
  lines; floor read back from hub.db + WAL (0.332.0 then, 0.333.0 now); host and controller reports from demo-hp, Tester 1
  and demo-felhom after the restart.

## 5. gofmt (R-1160)

Hub `d5e3c8b0` (22 files) and agent `1edfd8e` (14 files), formatting only, tests green before each. Gates: `hub-gofmt`
(`scripts/hub_gofmt_gate.py`, `repo_gates.py`) and `gofmt` (felhom-agent `scripts/gofmt_gate.py`, `agent_gates.py`), fast
set, decoys on scratch trees, red-proved. No agent release.

## 6. Controller release (decision 250)

Per-box floors 0.333.0 at 09:59:38 UTC → all three on 0.333.0 within about a minute (demo-hp from rc.2 at 10:13). Box
walk (`P6/`): 0 unhealthy, 0 allow-list refusals, catalog in sync; https-only 28 OK, 0 failures; „Fájlok ↗" with no second
login on demo-hp and Tester 1, sign-out asks again. **Global floor 0.333.0 / MinAgent 0.158.1 at 10:16:22 UTC**
(303 `floor_set`, read back with the WAL); per-box floors cleared.

## 7. Versions, commits, fixtures, rows

- **Controller 0.333.0** (`c809dd3`, `a6fa3c0`, REPORT `e1a2abf`), image digest
  `sha256:f150a8d8cd329f5cde9e34249e34edc59b6b5db29db1e3200900f3869a0de11b`; rc.1/rc.2 on demo-hp only. Fixtures:
  `escrow_first`, `escrow_receremony`.
- **Hub 0.160.0** (`d5e3c8b0`, `503c93fa`, `a17db0c3`, manifest `5d3cb5c1`).
- **Agent:** no release (`1edfd8e`, `0cbd500`). 0.160.0 stays the vouched one.
- **Rows: 167 before, 163 after; closed 6** (R-1155, R-1156, R-1157, R-1158, R-1160, R-1161), **opened 2** (R-1165,
  R-1166); R-1159 → READY (D19), R-1162 → NARROWED (one run to read).
- **System poster:** text only — `felhom-system-poster.facts.md` and the matching text in `felhom-system-poster.html`
  („last 2" → „one per week, 2 weeks").
- **Teardown:** machine — rc images only on demo-hp 9201, now on the release; no test app. Host — none. Hub — no test
  customer; the per-box floors cleared. ep0 — the two prune jobs changed on the operator's yes, nothing else.

## Observations

1. Two household namespaces on ep0 have no prune job; nothing creates one for a new household. FILED: R-1165.
2. Another device takes demo-hp's address 192.168.0.104 every few minutes; demo-hp also lost its link to ep0 for 8 minutes. FILED: R-1166.
3. A config download with the passphrase is a log line only, and the host key it yields can rewrite the box's escrow and recovery credential. FILED: R-1159.
4. The first R-1155 version missed FileBrowser's Basic-auth token source (the commit's security review). NOT-A-FINDING: fixed before any release in `a6fa3c0` and red-proved (the size rule).
5. Chrome offers „Install" for the file manager. NOT-A-FINDING: FileBrowser 1.5.6 has no setting that stops its manifest; the brief forbids patching it.
6. One of CC's probe scripts on DooPlex passed the household's FileBrowser token to curl on its command line (visible to local processes for about a second; never printed or saved). NOT-A-FINDING: CC's own tooling on DooPlex, not the product; every probe now passes tokens through 0600 header files, and the token expired two hours later.
7. Two copies of CC's hub-database snapshot ran into one folder at once and one read failed („malformed"). NOT-A-FINDING: CC's helper, a local copy only; the live hub and its database were untouched, and the next read was clean.
8. The first hub image push failed on a DNS timeout at DooPlex. NOT-A-FINDING: a short DNS outage (the website session saw it too); the build's own check found the tag absent and the retry pushed it.
9. FileBrowser's `admin` password login was not walked live. NOT-A-FINDING: CC holds no FileBrowser admin password; admin's token passing is unit-pinned and the sign-in page answers 200 live.