admin
b7fb2117ae
gates / gates (push) Successful in 20s
Part 1. Golden 0.208.0 baked on the drill VM, published and ROUND-TRIP VERIFIED — 656 150 362 B, sha256 ba668f59..5ffb82, and ./etc/felhom-controller-image read OUT of the downloaded archive says felhom-controller:0.208.0. Acceptance markers all green (overlay2 x1, mount points x2 rootfs+mp0, upload HTTP 201 x1, excluding/FATAL/mp1 x0), Result=success. Token file->file, read inside the VM; systemctl show grep = 0; committed-log grep = 0 WITH a control proving the grep works. Bake VM destroyed, drill disk restored to virgin. NOT VOUCHED — the campaign halts there deliberately. golden_currency_gate.py was correctly RED on arrival and is green after the bake. No --no-verify was needed anywhere in this session. Parts 2-4. Seven defect classes swept for siblings by class rather than by feature. Analysis only: no product code, nothing deployed, no machine touched beyond the bake VM. Eight new rows R-256..R-263 (ceiling moved from R-255), grouped by class in OPEN-ITEMS.md. C1 produced no new instance and has no row. The sharpest is R-260: the agent reports operator_key_configured every heartbeat, the hub has no field for it, so the check that answers "can the operator get into this box" returns ok for a box with no operator key installed. Every class states whether its method re-found the known instances, because a method that cannot re-find them has not been shown to work: C1 2/3 (verified by replaying the pre-fix templates), C2 2/2, C3 2/3 + 1 as fixed, C4 fix-pattern re-found, C5 re-found, C6 deadcode 0/2 and bespoke 1/2, C7 weakest and said so. Blind spots stated per class; seven suspicions investigated and DISPROVED, including two of my own methods. Part 4's ranking is in ROADMAP.md as G-1..G-8. Gate C5 (cross-repo tag reachability — cheap, --fast-eligible, would have caught every R-260 instance on the introducing commit). Do NOT gate C6: golang.org/x/tools/cmd/deadcode was measured against a PLANTED probe and is blind to unreachable METHODS on widely-used types, which is exactly the shape both known instances have. R-242's untouched half is recorded, not built: this bake demonstrated it, the currency gate flipping green the moment the evidence DIRECTORY existed, before the round trip finished and with no vouch near it. Correction the campaign owed its own brief: escrow_stale was described as closed; it is R-247 and READY. The live repo is the source. Sampled rather than swept, exactly: C7 60 of 2652 production invariant comments and NONE of the 1440 test comments (that half is owed); C2 19 of 221 refusals; C3/C4 controller only. No finding was reproduced live. STATUS.md is 100 lines against its 93-line one screen.
101 lines
6.5 KiB
Markdown
101 lines
6.5 KiB
Markdown
# STATUS — what works, what's broken, what's next
|
|
|
|
**Updated 2026-08-08 (overnight — Campaign 12).**
|
|
|
|
> **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
|
|
> part of it in plain words, and **nothing may exist only here**. Not `CONTEXT.md`, which is technical
|
|
> state written for Claude Code. **Items, not paragraphs. One screen.** If it does not fit, something
|
|
> belongs in the register instead.
|
|
>
|
|
> *Rebuilt from the register on 2026-08-07, from 258 lines. The old "what shipped recently" log is what
|
|
> the per-repo `CHANGELOG.md` files and the register are for, and is not restated here.*
|
|
|
|
## What works
|
|
|
|
A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer, who
|
|
sets their own password. They install apps from a catalogue of fifty-three, share files over the home
|
|
network, and open apps from a launcher or a shared link. Backups run on their own to three places — the
|
|
machine's drive, a second drive, and an encrypted off-site copy.
|
|
|
|
**The backup promise is proved, and so is getting the data back yourself.** A machine has been
|
|
destroyed on purpose and its files came back byte for byte identical — four times now, including a
|
|
filename with Hungarian accents. On **2026-08-07 the household's own journey passed for the first
|
|
time**: someone with a browser and their recovery code got everything back with **no command line
|
|
inside the machine at any point**. From logging in to seeing what is in the store took **72 seconds**.
|
|
*(R-201 — closed.)*
|
|
|
|
**And the two rough edges that walk found are gone** — after a rebuild the restore used to stop dead
|
|
twice; both refusals now say what happened, that nothing is lost, and link to the screen that fixes
|
|
it. *(R-252, R-253 — closed 2026-08-08.)*
|
|
|
|
## What's broken
|
|
|
|
- **Nothing new is broken.** All three secret-in-page faults are fixed; what remains is that the
|
|
*check* against a fourth covers 4 pages of 27, and the cheap one covering all of them is blind to
|
|
the shape that actually shipped. *(R-255)*
|
|
- **The machine's own screen keeps telling an already-paired box to pair itself** — 25 minutes after it
|
|
was paired, on a screen that promises it refreshes itself. *(R-214, R-235)*
|
|
- **A rebuilt machine cannot create a new recovery code at all.** *(R-221)*
|
|
- **A backup that covered nothing still calls itself „Sikeres".** The state is honest; the word is not.
|
|
*(R-240)*
|
|
- **A machine waiting for its recovery code can stop backing up off-site without alarming us.** After
|
|
a *rebuild* we ARE told; the gap is a box reaching that state with no working tier behind it. *(R-243)*
|
|
- **The card offering to reopen set-aside backups promises more than we can deliver** — we keep the old
|
|
sealed package, but nothing can open it. *(R-202)*
|
|
- **Deleting a customer leaves rows behind** on every test machine ever torn down, while reporting a
|
|
clean teardown. No secrets involved, but it accumulates with each walk. *(R-244)*
|
|
- **Putting restored files back where they belong is still a manual step.** *(R-213)*
|
|
|
|
## Found overnight — we went looking for siblings, on purpose
|
|
|
|
Every fault this month came in one of seven shapes; overnight we looked for the others **by shape** —
|
|
reading and counting only, nothing changed or deployed, no machine touched. Eight new items, none
|
|
urgent. Full working: `audits/CAMPAIGN-12-class-sweep-2026-08-08.md`.
|
|
|
|
- **The one that matters.** The machine tells us whether your engineer's emergency key is really
|
|
installed — and **we throw that sentence away before reading it**, so a box can read as "we can get
|
|
in" when nobody can. Same shape in seven other places. *(R-260)*
|
|
- **A green tick meaning only "a backup exists"** — any age counts, and it reddens on a problem
|
|
measured across all apps rather than that one. *(R-258)*
|
|
- **A disk we failed to measure is drawn as an empty, healthy one** — "0.0 GB / 0.0 GB (0%)" in the
|
|
normal colour, while the right pattern sits two files away. *(R-259)*
|
|
- **Two comments promise more than the code does** (one guarded by a test that cannot fail on the
|
|
thing it names), and **two refusals still stop at "no"**, one in half-English.
|
|
*(R-262, R-263, R-256, R-257)*
|
|
- **Which shapes can a machine catch from now on?** That mattered more than the list: **one is cheap
|
|
and worth doing** (the thrown-away-sentence one, which would have caught every instance on the day
|
|
it was written), two need a small decision first, and **two are honestly not automatable** —
|
|
including the one that looked most automatable, where the standard tool was tested and found blind.
|
|
Recorded, not built. *(ROADMAP G-1…G-8)*
|
|
|
|
## What we're working on
|
|
|
|
- **Widening the check** so a fourth secret-in-a-page is caught by a machine, not by someone. *(R-255)*
|
|
- **Proving the hub really keeps the old sealed key** when a machine re-seals — needs its own session
|
|
and a second deliberate wipe. *(R-198)*
|
|
|
|
## Waiting on you
|
|
|
|
- **One approval: the new base image.** Tonight's release is baked, published and byte-checked, and
|
|
**installations still receive yesterday's version until you press Save.** Hub → Configuration →
|
|
Day-0 artifacts → Golden **0.208.0** → Save. One field moves; the other two are already right and
|
|
were checked. Reversible — re-select 0.207.0 and Save. *(R-242)*
|
|
- **Third time in three days, so worth a minute.** A check now catches the *baking* being forgotten;
|
|
**nothing catches the approval being forgotten** — tonight's bake proved it, going green before the
|
|
approval existed. Two ways to close it are written up, neither built. *(ROADMAP G-8)*
|
|
|
|
## DooPlex infrastructure — separate from the product
|
|
|
|
*Kept under its own heading rather than dropped: these are real asks that need you, but they concern
|
|
the machine all this is built on, not what a customer receives. Mixing them in is why the page stopped
|
|
being readable.*
|
|
|
|
- **DooPlex's own backup keeps every copy inside the same box, and is silent when it fails.** *(R-232)*
|
|
- **193 old images exist only on this machine**, ~27 GB against 199 GB free — clutter, not space. *(R-210)*
|
|
- **The hub password needs rotating** — a diagnostic printed it into a session log; nothing suggests
|
|
anyone else saw it. *(R-132)*
|
|
- **One thing to read after DooPlex next restarts** — the second-SSD move has never survived a reboot;
|
|
it writes PASS/FAIL to `/var/log/felhom-store-postboot-check.log`. On PASS, 34 GB comes back. *(R-209a)*
|
|
- **Backup scripts on DooPlex are unversioned host state** *(R-231)*, and the instruction-file
|
|
follow-ups each need a decision rather than an edit *(R-229, R-230)*.
|