felhom.eu/REPORT-doorstep-1271.md

# REPORT — the doorstep: installer 1.27.1, hub 0.113.0, walked again (2026-09-14)

**Supervised task. STOPPED before publishing, as required.** Findings: `documentation/audits/DOORSTEP-walk-1270-2026-09-14.md`.
A parallel session owns root `REPORT.md`; this is a topic sibling.

## 0. Claims in the brief that turned out wrong — named first

1. **"The ISO is built to install itself with no questions."** Wrong for the public image. `--release`
   builds carry no answer file by construction (G1); the 1.26.1 manifest says `answer-file: NONE` and
   `automated-entry: NOT PRESENT`. The README's auto-install text describes the old operator-built images.
   Nothing "failed to engage".
2. **"The installer installs itself, in Hungarian" / "no English reaches a volunteer."** Not achievable
   under the operator's ruling: offered an install-time disk rule, he kept the interactive installer. The
   Proxmox auto-installer has no local chooser or stop page; its screens stay English. Felhom's own text is
   Hungarian (G16).
3. **"Tester 1, fully configured."** It has no e-mail (R-508) and its tunnel gives a new box no routes
   (R-505).
4. **"The hub could create the tunnel later" as the only gap in A.1.** `day0-install.md` A.1 also claimed the
   controller creates the hostnames; it does not (R-506, corrected).
5. **"Host a Hungarian chooser; else a Hungarian stop."** Not built — follows from 2.

## 1. Baselines (re-verified)

felhom.eu `8c7f882` at start · ISO `1.26.1` · host installer `1.28.0` (unchanged) · hub `0.112.0` ·
controller `0.242.0`, golden `0.242.0`. Highest row R-501.

## 2. Operator decisions taken in this task

| when | question | answer |
|---|---|---|
| Phase 0 | reverse to auto-install, or keep interactive? | **keep interactive** |
| Phase 4 | test domain for the walk? | **use customer `tester-1`** |
| Phase 4 | tunnel has no routes — add, or continue? | "works for me on mobile network … pi-hole" — see §5 |

## 3. What shipped, and what did not

| artifact | commit | state |
|---|---|---|
| hub **v0.113.0** — hand-over sentence on create + Credentials; self-bind mail names the operator (R-497) | `6fd8c87` code, `63f29c6` deploy | **LIVE** — ArgoCD Synced, image `0.113.0`, page renders it |
| ISO **1.27.0** — console fix at first boot | `6fd8c87` | built, gated, **superseded** (first boot still showed the Proxmox block) |
| ISO **1.27.1** — postinst masks `pvebanner` + writes `/etc/issue` | `27e8ec8` | built, **gate PASS**, proven live, **NOT PUBLISHED** · sha256 `25637007d5a7120ff9faa6b5b7ead3e33c0a361ac2d67e9fd4e0ee77c034c053` |
| release gate **G14–G16**; domain + installer rulings in `01-topology-and-trust.md` and `CONTEXT.md`; guide + day-0 A.1/A.2 aligned | `6fd8c87`, this commit | committed |
| download page `felhom.eu/letoltes` | — | **not written to the website** — the website publishes on push; it goes with the ISO after yes |

Tests: hub `passphrase_handover_test.go` red first, full `go test ./...` green; bootstrap harness 55/55,
eight R-496 checks and scenario PI red first; `shellcheck` clean; felhom.eu gates green on every push;
CI jobs 583, 585 `success`.

## 4. The walk

**Interventions: 1** — reaching the dashboard by LAN address (R-505, filed 16:07:59Z before acting).
Everything else held: install on 3 disks and 1, first-boot console Felhom-only on 1.27.1 with a proven
reboot, deploy, use, backup-now, removal, **byte-identical restore**, power cut on the same versions, typo
and lockout. Harness substitutions H1–H5 in the findings doc §4.

## 5. The tunnel, measured — the one thing that stops a volunteer

12 requests from DooPlex through public DNS → **12 × 503**; the box's `cloudflared` logged **12**
`No ingress rules were defined` in the same window and **0** remote-config updates since connecting. The
guest's own front door answers the name. **The operator's phone loads the dashboard** — not explained by
anything the session can see; a second connector reached from another Cloudflare location is the likeliest
cause and is **not established**. The Pi-hole is excluded for these probes (public DNS, Cloudflare ray ids).

## 6. STOP — for the operator

- **Intervention count: 1.** By the rule set for this task, **do not publish.**
- **The disk rule:** the installer never picks; it lists every disk with size and model and erases the one
  you choose; unplug the backup drive; call the operator if unsure. One disk, three disks and nobody at
  the keyboard were each seen (findings §2).
- **Gate:** 1.27.1 PASS on every criterion runnable before publish (G1–G10, G13–G16); G11/G12 are
  publish-time; the graphical entry is proven only to its password screen (R-507).
- **Ready: NO** — until the `tester-1` tunnel answers from our network, and the record has an e-mail.
- **What publishing would do, on yes:** upload 1.27.1 + `.sha256` + manifest to the bucket, add the
  download page to the website, round-trip the checksum over `https://iso.felhom.eu/`, keep 1.26.1 online
  so rollback is one link change.

## 7. Rows

Opened **R-502 … R-508** (7). Closed **R-497**. Fixed awaiting publish **R-496**; answered awaiting publish
**R-495**; **R-493** open; **R-494** narrowed to P3. Register table rows **209 → 216**.

## 8. Teardown

Layers 1–2 done (VMs 331/332 destroyed; ≈12.8 GiB back on `nvme-scratch`; both ISOs and `/root/doorstep`
gone; 9201/9202 untouched). Layer 3: appliance 27 discarded (16:20Z); host `tester-1-8603a2` stale at 16:46:43Z (a true
`host_stale` operator mail), deleted 16:46:52Z (`host deleted: tester-1-8603a2 (escrow deleted: false)`;
host page 404, gone from `/hosts`); its ep0 WireGuard peer `10.77.0.5` removed at the 16:49:13Z push
(0 left, control peer 1). **Customer `tester-1` KEPT** (page 200). **Left on ep0 by the DR tier, read-only
check 16:51Z:** namespace `tester-1` exists with **2 directories inside — backup data from the test box**,
plus token `felhom@pbs!tester-1`. Not removed: ep0 is protected, and the only product path (customer
RESET) would also remove the tunnel. Retained for the operator's ruling.
The hub's event stream and three operator mails are append-only and stay.

## 9. Observations

- `iso-release-gate.md`'s "both entries" proof depends on a person for the graphical entry today (R-507).
- The bootstrap harness is run by hand only (R-502); the pairing banner had never been exercised.
- A closed row still lives in the open register (R-497) until the next compression sweep — the gates accept it.