admin
3159892fab
gates / gates (push) Successful in 27s
- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202 through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today. - Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored — two wiring faults found live on 9202); floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger. - Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK. - Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446. - register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red. Evidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/. Report: REPORT-night-rulings-2026-09-30.md. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
56 lines
3.6 KiB
Markdown
56 lines
3.6 KiB
Markdown
# STATUS — what works, what's broken, what's next
|
|
|
|
**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
|
|
|
|
**Updated 2026-09-30 (late evening). Both demo boxes run controller 0.284.2 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.284.2 with agent 0.138.0.**
|
|
|
|
**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
|
|
|
|
## Your two decisions of tonight — built
|
|
|
|
- **Security fixes under the same name (your A).** The catalog can now re-test a database image's new fix and record
|
|
it as a tested step. A box then takes it at night by itself. Tested from start to end on the scratch box: the night
|
|
run took the fix, the app kept its data, and the page went back to "up to date". **Today there was nothing to re-test**
|
|
for the database and redis images.
|
|
- **Old program files on the disk (your A).** A box now keeps each app's current program and the one before it, and
|
|
deletes the older ones. It never deletes one that another app still uses. On the first start it cleaned up once:
|
|
**the HP demo box freed 11 GB**, the scratch box 21 GB. All apps kept running.
|
|
|
|
## What else I did, and it worked
|
|
|
|
- **The short login risk is closed.** After an install, an app with a known default password is now closed to
|
|
strangers until the box has changed that password. Tested on two apps: no stranger got in.
|
|
- **wger's phone app can log in** now (its missing key is made at the first start).
|
|
- **New controller 0.284.2** is on both demo boxes, and **a new golden 0.284.2** is baked and vouched. The golden check
|
|
is green (not just waived).
|
|
|
|
## What broke, and what I did
|
|
|
|
- **The clean-up first missed most images.** Two mistakes, both found on the scratch box before any demo box got the
|
|
release: it did not run on the Remove button, and it could not see images stored without a name. Both fixed and
|
|
tested. That is why the version is 0.284.2 (0.284.0 and 0.284.1 never went out).
|
|
- **wanderer** can now run on the test bench, but its update is not tested yet: I could not create test data in it.
|
|
Also found: its search engine needs one extra setting before any update, or it refuses to start.
|
|
- **Two exact versions were rebuilt by their makers under the same name** (nextcloud and sonarr). The monthly re-test
|
|
finds them. Tonight I only did the database images, as you ruled.
|
|
- **mealie locks the account after five wrong passwords** — also when a stranger types them. Written down.
|
|
- **Old controller versions** still pile up on each box (about 50). Your rule covered apps only. Written down.
|
|
|
|
**Rows.** Tonight: 5 closed, 3 narrowed, 6 opened. The list went from 377 to 383 rows (counted with every row, including three whose number has a letter — the old check skipped those).
|
|
|
|
## What needs you
|
|
|
|
1. **Who presses the monthly re-test?** It is one command, but it needs the test bench and the scratch box set up
|
|
first, so it cannot run by itself (the steps are written down). Options: CC does it in a monthly session, or you
|
|
start it. If nobody presses it, same-name security fixes wait until the next time we move that app.
|
|
2. **Should the monthly re-test cover every app, or only databases?** Exact versions get rebuilt too (nextcloud,
|
|
sonarr). If you do nothing, only databases are re-tested.
|
|
3. **Old controller versions:** keep only the current and the previous one? If you do nothing, about 150 MB per release
|
|
keeps piling up.
|
|
4. **No golden bake is due** — tonight's bake carries the newest controller.
|
|
|
|
## Standing steps
|
|
|
|
- **Monthly:** the same-name security re-test (runbook `monthly-floating-retest.md`).
|
|
- **Weekly:** the golden bake (around 7 October).
|