admin
460135a15a
gates / gates (push) Successful in 3m57s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
84 lines
5.2 KiB
Markdown
84 lines
5.2 KiB
Markdown
# REPORT — the dashboard on the website (2026-10-08)
|
||
|
||
> `REPORT-website-dashboard.md`, not `REPORT.md`: another session works in this repo today. This file replaces this
|
||
> morning's „stopped at the baseline" version of it (commit 4b5f74e4); the operator then approved moving 9202 to the
|
||
> fleet's controller and said the physical demo boxes are test boxes too.
|
||
|
||
| Part | What | State |
|
||
|---|---|---|
|
||
| Baseline | a box on the fleet's controller (0.303.0) | 9202 moved 0.301.0 → 0.303.0 (operator's word); pictures finally from demo-hp's household guest 9201 (see below) |
|
||
| A | scene + screenshots, hu and en, privacy check | **Done** — 8 pictures published, 6 taken and kept off the site |
|
||
| B | home-page section, technology page, captions as claims, gate 19 + decoy | **Done** |
|
||
| C | rules, CHANGELOG, STATUS, rows | **Done** — two rows for dashboard defects (R-906, R-907) |
|
||
|
||
**Register:** before **129**, after **131**, opened **2** (R-906, R-907), closed **0**.
|
||
|
||
## Why the pictures come from 9201, not 9202
|
||
|
||
On 9202 (now 0.303.0) four family apps were installed and a real backup ran, but **every page carried „+ 5 további
|
||
figyelmeztetés"**: nine `disk-not-separate` warnings (9202's „second drive" is a folder on the host disk, plus earlier
|
||
sessions' leftover folders) and the hub-off warning — true for a scratch guest, not a household's normal state. Faking it
|
||
away was not an option. demo-hp's household guest 9201 runs 0.303.0 with **no alerts** (`/api/debug/dump` →
|
||
`alerts: []`) and last night's app backups OK, so the pictures were taken there, read only. The one change: the
|
||
household language switched to English for the English pictures and back to Hungarian right after (both 302; read back
|
||
`lang="hu"`, first sidebar item „Indítópult").
|
||
|
||
## Pictures (`website/assets/`, 1440 × 900 WebP)
|
||
|
||
| Picture | hu bytes | en bytes | On |
|
||
|---|---|---|---|
|
||
| `dashboard-start` (Launcher) | 34,024 | 31,948 | home |
|
||
| `dashboard-apps` (Apps) | 59,018 | 54,156 | home, technology |
|
||
| `dashboard-app` (Paperless-ngx's page) | 83,124 | 78,992 | home |
|
||
| `dashboard-backups` (Backup → Apps) | 52,638 | 45,292 | home, technology |
|
||
|
||
Kept off the site: the backups overview (a true amber „whole-box backup on the system disk" notice on demo-hp), the System
|
||
page (operator details), the phone view (the launcher's share button runs off the edge at 390 px — R-907).
|
||
|
||
## Privacy check, per picture (`documentation/audits/website-dashboard-2026-10-08/privacy-scan.txt`)
|
||
|
||
Searched in each page's text (body, title/alt/placeholder/input values): e-mail addresses, IPv4 addresses, long hex
|
||
(tokens/keys), the host's serial, password/recovery words, any domain other than the test domain. **All 8: 0 e-mails,
|
||
0 IPs, 0 serials, no domain but `enkisfelhom.hu` (demo-hp's demo test domain) and `felhom.eu`.** One long hex per page =
|
||
the hidden CSRF field, not visible in the picture. Password-word hits on the app pages are help text, not a password.
|
||
**Positive control:** an app name known to be on the page (`Paperless-ngx` / `BookStack`) — found 8 of 8.
|
||
|
||
## Captions = claims (`captions-claims.md`)
|
||
|
||
Launcher → map E Indítópult (IMPLEMENTED); Apps → map B deploy + version (PROVEN-LIVE); an app's page → map B app
|
||
lifecycle (PROVEN-LIVE) + catalog copy + file access (IMPLEMENTED); Backup → Apps → map C nightly DB dumps (PROVEN-LIVE).
|
||
|
||
## Clean-up
|
||
|
||
9202: Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (data and backups too); Paperless-ngx
|
||
(running) and PrivateBin (stopped) were there before and are as found; screenshot folder removed, session files
|
||
shredded; 9202 stays on 0.303.0. 9201: language back to Hungarian. demo-hp host: only `pct exec`/`pct list`. Hub:
|
||
nothing. demo-felhom: one read-only `pct list` + `docker ps` (only one app there, so not used).
|
||
|
||
## Gate 19 decoy (`decoy.txt`)
|
||
|
||
Mutation: `website/en/index.html` `dashboard-start-en.webp` → `dashboard-start-hu.webp`.
|
||
Failure line: `FAIL: en/index.html: a hu dashboard picture (/assets/dashboard-start-hu.webp) on a en page — use the page's own language`.
|
||
Also in `scripts/test_gate_decoys.py` as `site/dashboard-picture-wrong-language` (with `must=` on that line).
|
||
|
||
## Rows filed (dashboard defects seen in the pictures; controller not changed)
|
||
|
||
- **R-906** (P4): a page can show „+5 more warnings" with none above it — the overflow is counted before the page filter.
|
||
- **R-907** (P4): on a phone the Launcher's share button runs off the right edge.
|
||
|
||
## Live check (after git-sync; `live-check.txt`, `live-*.png`)
|
||
|
||
`/`, `/en/`, `/technologiak`, `/en/technology`, the pictures and `site.css?v=4` answer 200. Headless Chrome on the
|
||
live site: each home page shows its own four pictures, all loaded; at 1280 px two per row (514 px wide), at 376 px one
|
||
per row (328 px), scrollWidth = innerWidth (no sideways scroll), both languages.
|
||
|
||
## Files and pushes
|
||
|
||
**aaac24b0**: 16 pages, `site.css`, 8 `dashboard-*.webp`, `website/CHANGELOG.md`, `scripts/site_gates.py`,
|
||
`scripts/test_gate_decoys.py`, `scripts/CHANGELOG.md`, `.claude/rules/website.md`, `OPEN-ITEMS.md`, `STATUS.md`,
|
||
this report, the audit folder. The live check and this section: the next commit.
|
||
|
||
## Decision for you
|
||
|
||
None. Look at the home page once (`felhom.eu/#vezerlopult`, `felhom.eu/en/#dashboard`).
|