# restic/Storage-Box isolation proof — subaccount u629488-sub4 (home felhom-campaign10)
# box 611714 storage-box-pool-1 · server u629488.your-storagebox.de · 2026-07-31T20:15:55Z
# Production subaccounts on the SAME box: sub1=felhom-demo-felhom sub2=felhom-peti-felhom sub3=felhom-demo-hp
# Password never echoed; supplied to sshpass via env.

## POSITIVE CONTROL — sub4 in its OWN home (must SUCCEED)
$ sftp> pwd ; ls -a ; put canary ; ls
Warning: Permanently added '[u629488.your-storagebox.de]:23' (ED25519) to the list of known hosts.
Connected to u629488.your-storagebox.de.
sftp> pwd
Remote working directory: /home
sftp> ls -a
.   ..  

## DENIAL 1 — reach Peti's REAL customer repo path from sub4
$ sftp> cd /home/felhom-peti-felhom  /  cd ../felhom-peti-felhom  /  ls /felhom-peti-felhom
Connected to u629488.your-storagebox.de.
sftp> cd /home/felhom-peti-felhom
stat remote: No such file or directory
sftp> cd ../felhom-peti-felhom
stat remote: No such file or directory
sftp> ls /felhom-peti-felhom
Can't ls: "/felhom-peti-felhom" not found
sftp> ls ..
remote readdir("/home/../"): Permission denied

## DENIAL 2 — reach demo-felhom's and demo-hp's production repo paths
Connected to u629488.your-storagebox.de.
sftp> cd /home/felhom-demo-felhom
stat remote: No such file or directory
sftp> ls /felhom-demo-felhom
Can't ls: "/felhom-demo-felhom" not found
sftp> cd /home/felhom-demo-hp
stat remote: No such file or directory
sftp> ls /felhom-demo-hp
Can't ls: "/felhom-demo-hp" not found

## POSITIVE CONTROL (STRENGTHENED) — sub4 must be able to WRITE and READ BACK in its own home,
## proving the credential is fully functional and the denials above are AUTHORIZATION, not a dud login.
Connected to u629488.your-storagebox.de.
sftp> put /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt c10-canary.txt
Uploading /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt to /home/c10-canary.txt
sftp> ls -l
-rw-rw-r--    ? u629488-sub4 1059           56 Jul 31 22:16 c10-canary.txt
sftp> get c10-canary.txt /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
Fetching /home/c10-canary.txt to /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
sftp> rm c10-canary.txt
Removing /home/c10-canary.txt
sftp> ls -l
readback content: campaign10 write-capability canary 2026-07-31T20:16:23Z

## VERDICT: write+read succeed in own home; every production path is outside the chroot
## ('No such file or directory') and the parent directory is an explicit 'Permission denied'.