felhom.eu/REPORT-visitors-2026-10-01.md

# REPORT — the box tells visitors apart; the permanent-gate spike; SparkyFitness; R-772/R-773; release + golden (2026-10-01 night)

## The Part table

| Part | Result | Notes |
|---|---|---|
| **A** — visitors apart (build) | **DONE, with one change to the brief's sketch and one leg unmeasured** | The sketch plus 2 costs paid in the same rollout: a header clean-up at traefik, and 19 catalog router resets for the apps that read the LEFTMOST address. The brief named neither. ep0's one request was refused by Cloudflare before the box (R-779). |
| **B** — permanent family gate (spike) | **DONE — PASS** on exit items 1–5; costs measured | Exit test committed before the run. Build plan: 2 sessions. Waits for the operator (R-780). |
| **C** — SparkyFitness record | **DONE, with 7 rows open** | Bench (9401 rebuilt and destroyed) and 9202 measured. **Its licence forbids commercial use** (R-784, operator). |
| **D** — R-772, R-773 | **DONE** | Both red-proven and live on 9202. R-772 needed a second fix found live (0.286.0 → 0.286.1). |
| **E** — release, floor, golden | **DONE** | Controller 0.286.1 floored (min_agent 0.131.0); both demo boxes took it and reconciled traefik/cloudflared by themselves. Golden 0.286.1 baked, round-tripped and vouched; the currency gate is OK, not waived. |

Baselines (re-verified): controller `c1b123c64955`, agent `d766666ff8cf`, felhom.eu `bc9c7b49346b`, catalog `94477cba435a`.
Ends at: controller `a4a753b` (v0.286.1), catalog `de0a9bd`, felhom.eu (this commit). Agent untouched.
Architecture read: `01-topology-and-trust.md` §5 and §7 (both corrected), `09` §3 decisions 45–49, 57–62; decision 63 added
first (operator ruling).

## Claims in the brief that turned out wrong (or right), named

- *`clientIP` takes the leftmost hop.* **Right** (`claim.go:232`, pre-0.286).
- *A stranger can lock the household out of the dashboard.* **Right, through the tunnel only.** Every tunnel visitor shared
  cloudflared's address as the key; a LAN visitor always had its own key.
- *Cloudflare appends to a client-sent `X-Forwarded-For`.* **Right, measured:** `6.6.6.6,37.191.56.193` (M2). Also
  measured, not in the brief:
  - Cloudflare passes a client's `X-Forwarded-Host` and `X-Forwarded-Port` unchanged.
  - It strips a client's `X-Real-IP`.
  - It refuses a client-sent `CF-Connecting-IP` at the edge (403).
- *cloudflared's address is docker-assigned.* **Right** (`172.18.0.5`, no `ipv4_address`).
- *The setup gate's token is minted only from a dashboard session.* **Right** (`ServeGateStart`, one caller). But **"the
  setup gate uses [the visitor address]" was wrong:** the gate read no client address at all, so there was nothing to
  switch over. It now logs the visitor.
- *"Any reader takes the address at a fixed distance from the RIGHT."* **Half wrong.** The distance differs by path:
  second from the right through the tunnel, first on the LAN. So a fixed count is wrong for one of the two paths, and
  readers must skip trusted proxies from the right. Count readers (calibre-web, tandoor, wger) were left alone for that
  reason.
- *The sketch (traefik trusts cloudflared) is enough.* **Not on its own.** Trusting cloudflared makes the leftmost entry
  — written by a stranger — reach every app. 19 apps read exactly that one (several for rate limits: audiobookshelf and
  docmost by address only, papra skips its limit on a junk value). It also lets a stranger's `X-Forwarded-Host` through.
  Both were closed in the same rollout.
- *calibre-web `TRUSTED_PROXY_COUNT`, wger `AXES_*` proxy count.* **Left as they are.** Both are count readers, and both
  lock per NAME (decisions 58, 61). A count of 2 would break the LAN path, and for calibre-web also its proto/host.
- *Grimmory improves.* **Right as read in source; not measured in this session** (R-775 updated).

## Part A — the box tells visitors apart

- **Paths**: `audits/visitors-2026-10-01/A/` — M1–M4 before, M5 after, DESIGN.md (the path table, the options, the choice,
  the docs quoted).
- **Built** (controller v0.286.0/.1):
  - A `felhom-tunnel` network `172.16.253.0/29` with docker's allocation confined to `.4/30`. The hand prototype found
    traefik grabbing `.2`, so cloudflared now sits at a fixed `.2` and traefik at a fixed `.3`.
  - traefik trusts `172.16.253.2/32` only, and runs `felhom-forwarded@file`.
  - `EnsureBaseStack` reconciles a running traefik or cloudflared.
  - `clientaddr.go`, plus IPv6 counted per /64.
  - The dashboard login messages are informal, in both languages.
- **Red-proofs**: RP-A1, RP-A2 and RP-A3 each fail on their mutant.
- **Live**:
  - **9202, simulated tunnel:** a stranger rotating a forged leftmost address was locked after 5 tries; the household
    from another address got in at once; LAN and impostor forgeries were counted as themselves (L1).
  - **demo-hp, real tunnel:** an app sees `6.6.6.6,37.191.56.193, 172.16.253.2`. The dashboard counter was keyed on
    `37.191.56.193` and locked after 5. Every app answered (L2, M5, E/).
  - **ep0's one request:** refused 403 by Cloudflare's edge, with no line in the box's log, so the second outside
    address is unmeasured on the real tunnel → **R-779**.
- **Apps** (sweep of all 56 apps plus Grimmory and MeTube, read in source: `A/sweep/`):
  - **19 router resets**, one commit each, shipped before the release. docmost on the real tunnel still throttles a
    rotating forger.
  - **BookStack `APP_PROXIES`**, with 3.6 re-measured before and after: the household is no longer throttled by the
    stranger.
  - **Gains with no change:** Home Assistant (it treated every internet visitor as "local"), actualbudget, immich,
    dawarich, claper, termix, Grimmory.
  - **Open:** kimai, zipline, vikunja, nextcloud (R-776); Emby and Jellyfin LAN rights (R-777).
  - **Checklist 3.10** added.

## Part B — the permanent gate (spike)

`audits/permanent-gate-2026-10-01/VERDICT.md`. **PASS** on items 1–5.
- 36 stranger requests, 0 reached an app.
- Family members got their own 30-day logins, websockets worked, and logout worked.
- A stranger's guesses locked only him.
- OPDS, Kobo and KOReader worked through anchored exceptions, with the app's own login still in force.
- The family login never opened the dashboard.

Costs: +0.4 ms per request; with the gate down, apps answer 500 (closed); the build is 2 sessions. One build
requirement: anchor every exception (`/api/v1/opdsx` slipped past an unanchored prefix; Grimmory's own login still
refused it). Fully torn down.

## Part C — SparkyFitness

`app-catalog-felhom.eu/onboarding/sparkyfitness.md`.
- **Bench:** 5.1 server 33 %; 5.2 server 38 % and db 53 % under a heavy burst, 0 kills; 1.4 v0.17.2 → v0.17.3 proven;
  2.1 CLEAN; 9.1 green.
- **9202:**
  - A stranger got nothing during install.
  - Sign-up was blocked in 3 spellings, and blocked again after remove + restore.
  - Sign-in limit (3.6): ~10 s for everyone (R-783).
  - 4.4: the state read degraded within 10 s.
  - Backup → remove → restore read the data back.
- **Open:** 0.1 licence (**R-784 — non-commercial only**), 0.5, 0.7, 1.6, 1.7, 5.4, 8.3 (R-786). The pin is 11 releases
  and a major behind (R-785). A licence sweep of the whole catalog is owed (R-787).

## Part D — R-772, R-773

- **R-772:** not-run → `healthy:false, not_checked:true`, plus a line on the app page. 0.286.0 still waited for the
  last healthy record's 5-minute interval; 0.286.1 sees it on the next tick. **Live:** not_checked 14 s after the stop,
  healthy 42 s after the start. Red-proofs RP-D1 and RP-D1b. Readers of `health_probe`: the state override and the
  API/page only; the hub never sees it.
- **R-773:** a restore of a removed app writes the lock record (`opened_by: restore`) and the block before the start.
  **Live** on Karakeep and SparkyFitness: a stranger got 403 after remove + restore. Red-proof RP-D2.

## Part E — release, floor, golden

- **Release:** controller 0.286.1. Full suite rc 0, gates green. 0.286.0 ran on 9202 only.
- **Floor:** `0.286.1` + `min_agent 0.131.0` → demo-hp and demo-felhom on 0.286.1 within ~60 s. Each created the
  network, recreated traefik and moved cloudflared by itself (`E/rollout-*.txt`).
- **Golden 0.286.1** (`documentation/tests/golden-0.286.1-2026-10-01/`):
  - sha `1dec051d…a89`; the round trip is equal; token leaks 0, with the positive control at 1.
  - Vouched: golden 0.286.1 / agent 0.138.0 / min_agent 0.131.0. The hub then refused golden 0.285.0.
  - `golden_currency_gate`: OK (not waived). The waiver was not renewed — the bake ran.

## Rows

- **Closed:** R-753, R-754, R-772, R-773.
- **Narrowed:** R-775.
- **Opened:** R-776..R-787 (12).
- **Register:** 410 → 422.
- **Capability map:** two rows added (PARTIAL: visitors apart; MISSING/spiked: the family gate).
- **`unproven.py`:** unchanged — 35 of 55 not walked.

## Teardown (three layers)

- **Machine:**
  - 9202: karakeep, bookstack and sparkyfitness removed with their data and backups through the product; the echo
    containers, the spike (gate, Grimmory, MariaDB, MeTube, volumes, network, dynamic file), test images and helper
    files removed. 9202 keeps controller 0.286.1, its new traefik config and `felhom-tunnel` — the product's own.
  - demo-hp 9201: `a1-echo` and its image removed; its traefik config was restored after the M2 minute, and is now the
    release's.
- **Host:** the bench 9401 was rebuilt and destroyed (`pvesm` before/after in `C/bench/C0`, `C9`). The drill VM is
  powered off and reverted to `virgin`; CT 9100 destroyed.
- **Hub:** the floor and the artifact manifest changed on purpose (above); no customer or appliance records created.
- **ep0:** one HTTP request, nothing else.