felhom.eu/documentation/audits/CAMPAIGN-6B-2026-07-14-PROMPT.md

CAMPAIGN-6B — UNATTENDED close-out of the C6 remainder (.fab upload circle · browser planes · backup tiers · regression)

Class: Unattended "no mercy" continuation of CAMPAIGN-6. Findings only — NO code fixes, NO spec-writing however obvious. Output: felhom.eu/documentation/audits/CAMPAIGN-6B-<date>.md (C3/4/5/6A structure). Continue the ledger + evidence at 180:~/campaign6/. Record a new launch seed. No fixed time budget — the run ends when the checklist is complete.

THE OPERATING MODE — read this first (it is the whole point)

This run is UNATTENDED. Viktor is NOT at the keyboard. Do NOT BLOCK-and-wait.

• All reboots — guest AND host, both boxes — are PRE-AUTHORIZED. Drive them yourself (pct reboot 9201, host systemctl reboot). This is a dev/test environment; there is no evidence-banking delay and no per-reboot approval. The CAMPAIGN-6A supervised run already proved the reboot plane is safe; 6B does not re-ask.
• exportfs toggles on the campaign share are pre-authorized (same safety line: campaign felhom-campaign6 export ONLY; never non-felhom exports; never stop DooPlex services).
• teszt_enroll drive destructive ops are pre-authorized. Demo's ~20 existing apps: start/stop/ backup only — never delete/wipe/redeploy-over. Campaign apps + drill: free chaos. Escrow ceremonies: drill only; every R scratch + uncommitted.
• DEFERRAL IS STILL BANNED, but so is BLOCKING. Do not stop to ask permission. HALT ONLY IF a genuine, unrecoverable decision is required (e.g. a truly ambiguous destructive choice with no safe default, or missing credentials) — and even then, prefer the safe default and ledger it. Running low on context is NOT a halt reason: instead, wrap what is done into the doc, write a CAMPAIGN-6C continuation prompt, and stop cleanly (the 6A pattern). Every checklist item ends as PASS / FAIL / FINDING / (operator-authorized) split-to-6C — never blank, never "deferred".
• If a reboot/host action does not come back, use the CAMPAIGN-6A morning-recovery steps and ledger it as a FAIL with the diagnostic, then continue (continue-on-failure).

Pre-existing state (left ready by CAMPAIGN-6A — verify at P0, don't trust this)

• controller 0.129.0 both guests · agent 0.88.0 both hosts · hub 0.54.0. caps 63/63 both.
• campaign6 NFS share still enrolled on demo (192.168.0.180:/mnt/5_hdd/felhom-campaign6 → /mnt/felhom-drives/campaign6, idle); sonarr deployed on it (stopped); DooPlex export active.
• Credentials unchanged from CAMPAIGN-4/5/6A: controller AND hub dashboard = the campaign credential. Never commit it; ledger says "campaign credential"; rotate only at the very end.
• P7 samplers (c5demo/c5drill, c4-sampler.sh) still running on both PVE hosts — reuse them.
• Access: SSH=/c/Windows/System32/OpenSSH/ssh.exe. 180=DooPlex (passwordless sudo), felhom-pve=demo host, root@192.168.0.152=drill host. Controllers driven via docker exec <ctrl> curl 127.0.0.1:8080 (real login→CSRF) or claude-in-chrome for the browser planes.

Findings already banked in 6A (do NOT re-hunt; watch for related regressions)

• C6-1 (LOW-MED): skip-active is a no-op on pct reboot — the guest-hook heal re-arm carries every active-share reboot; the "fresh namespaces inherit real mounts" log is misleading.
• C6-2 (MED): a NAS outage spanning a guest reboot can strand the share failed until an agent restart (or periodic sweep — timing unmeasured; 6B: measure the periodic-sweep interval if a cheap opportunity arises).
• C6-3 (LOW, setup): the agent/wizard don't pre-create an app's userdata tree on a fresh all_squash NFS export → docker chown fails → container stuck Created until pre-created.
• F-A / F-B / F-C are already confirmed-fixed-live (CAMPAIGN-5, same 0.129.0 fleet). 6B may spot-re-confirm opportunistically but need not re-prove them.

P0 (fast) — verify the pre-existing state, record a seed, then GO

Versions both; caps 63/63; campaign6 enrolled+health; sonarr present; escrow states; samplers alive. Push to 180:~/campaign6/evidence/P0-6B/.

PHASE 2 — the .fab full circle, UPLOAD half (demo; twice-deferred flagship)

Fresh campaign app + ~4 GiB /dev/urandom (varied sizes incl one >1 GiB); sha256 manifest. Export → .fab (progress honesty + atomicity). Download twice — browser/LAN AND curl with the session cookie through the real Cloudflare edge (--resolve <host>:443:<CF-public-IP> — Pi-hole split-horizon bypasses the edge otherwise); both hashes == the docker-cp reference. Re-prove the edge cap: single >100 MB POST → 413 from Cloudflare. Delete the campaign app + data. Upload back — browser/LAN AND curl --resolve through the edge in 64 MiB chunks. Import/restore; byte-compare every file vs the manifest → zero mismatches = PASS. Edge volley (live over the unit tests): cancel mid-upload → abort + .part gone; controller restart mid-upload → startup GC count logged; offset replay → 409+resync; oversize-vs-free → Hungarian refusal (both numbers) AND F-A real multi-GB size; collision → " (1)" then " (2)"; second concurrent init → 409; wrong extension refused; idle 15-min abort (park one, return). (Note the storage-bearing box + a proper export are required — see C6-3; pre-create the userdata tree.)

PHASE 3 — browser planes (claude-in-chrome; twice-deferred)

Session must be started AFTER the chrome bridge connected. Campaign credential for login.

• 3A escrow wizard, full browser pass (drill): preflight all-green + Hungarian details (no raw English leak), warnings, re-auth, run, reveal, typed-back with the two highlighted words (read from screen), manual hide/show toggle, finish → auto-confirm flips + hub row hash matches (server-side check via 180). Then re-claim → 410 UI; unclaimed → TTL → unclaimed_void screen; F-C live (phase:none claim → clean 4xx UI, not 502); out-of-band CLI ceremony w/o staged secret → stale card fires → wizard clears it.
• 3B DOM / native-alert / session sweep (both boxes): grep served DOM for alert(/confirm( (must be zero); session expiry mid-wizard and mid-upload → JSON 401 on /api/, redirect on pages; CSRF stale-token on storage-wizard/escrow/upload POSTs → 403 JSON; zero-toggle honesty + inline two-step confirms; F-B live quick re-check.
• 3C hub 8-tab customer-detail ring (hub credential = campaign credential): hash-nav across all 8 tabs; auto-refresh scoped to live tabs; dirty-form suppression (start editing → refresh holds); events tab under volume; no stale-host deletion against real hosts (synthetic row only).

PHASE 4-rest — backup tiers depth + NAS integrity

• F7 mid-backup NAS cut: POST /api/backup/run on a NAS app; exportfs -u at T+~6s; the last-good volume dump must survive (tmp+rename) — no 0-byte artifact; success:false is the only signal. (Give the app enough data that the dump takes >6 s.)
• Four backup sub-pages truth vs live; offsite card three honest states; Tier-3 "Távoli mentés most" additive + quota bar; restic stale-lock self-heal (kill controller mid-offsite-run → next run self-heals the lock); tier-1 replace-semantics; offsite restore-to-verify to a scratch target (campaign app) — byte-identical; volume-only app gets its tier-2 secondary (F6 fix); per-app toggles round-trip; snapshot coherence across pages. (F8 already CONFIRMED in 6A — cite it.)

PHASE 5 — regression spot-checks (fast)

• Agent-restart re-arm still logs per-share verdicts (6A re-showed it via 1E netmigrate — one quick re-confirm). F1/F2 residue after the campaign share's final removal — zero mounts/units/ dirs, host+guest. F4 mapped_uid:101000 → friendly Hungarian 400 (not agent_error). Dead-app alert + email on a killed campaign container (cooldown math vs the run's emails).

Wrap — completeness gate (same as 6A)

Checklist table of EVERY 6B item = PASS / FAIL / FINDING / (operator-authorized) split-to-6C. Verdict; ranked findings + repros; timings; deviations; box state (both boxes; "campaign credential active — Viktor rotates"; drill fresh-R note); morning recovery; evidence index. Commit the doc + overwrite felhom.eu/REPORT.md. No credential, no R, no blob committed.

Final cleanup (unattended — do it, no BLOCK; show before/after in the ledger)

Remove campaign6 share + campaign apps (product flow); sudo exportfs -u 192.168.0.162:/mnt/5_hdd/felhom-campaign6 && sudo rm -rf /mnt/5_hdd/felhom-campaign6 on 180 (confirm exportfs -v back to the P0 baseline, felhom-data intact); remove scratch .fab + injected data; stop the samplers (pkill -f c4-sampler.sh both PVE hosts, pkill -f hub-sampler.sh on 180). Leave the campaign credential in place and note in the doc that Viktor rotates it — that is the one human step that remains after 6B.