admin ab3b7ea2f4 hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172) ...

KernelDue / KernelNotify (09-20 h Budapest, one per 20 h, max 3, registered
address, only an accepted mail counts) / os_update.kernel {kver, tonight}
(no mail, no step) / layer kernel ingest + operator events / Approve kernel
set after every ring-0 box booted it healthily after a night stage / two
System page cells. 11 §5.11 written; §5.10 status corrected (proven).
Installer uninstall knows the two GRUB generators (unreleased).
Evidence: audits/kernel-lane-2026-10-07/ (red-proofs, boot timing).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-07 15:34:14 +02:00

..

static

…

templates

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

appliances_test.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

appliances.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

apps_render_test.go

…

apps.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

artifact_choices_test.go

hub v0.101.0 — memoise the artifact dropdown for 60s (R-267, operator ruling)

2026-08-08 20:08:51 +02:00

artifact_installability_test.go

hub v0.102.0 — refuse to vouch a version that cannot be installed (R-273)

2026-08-09 19:13:45 +02:00

artifacts_form_render_test.go

hub v0.68.1 — fix the Configuration layout broken by the wrapper-sha field

2026-07-21 10:34:34 +02:00

backup_card.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

bind_language_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

change_password_test.go

@

2026-07-13 22:46:49 +02:00

claim_ui_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

configs_debug_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

configs_delivery_render_test.go

hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

2026-07-23 12:59:04 +02:00

configs_offsite_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

configs.go

R-31: a second off-site Save while the first still provisions is refused, not raced

2026-10-06 21:04:54 +02:00

controller.yaml.default

hub v0.50.0: customer-claim arc docs (CHANGELOG, default template claim_code_* fields, REUSE rows)

2026-07-12 18:45:43 +02:00

customer_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_delete.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_edit_tab_test.go

R-32 (decision 167): RESET purges the off-site folder through the sub-account's own login before deleting it

2026-10-07 10:21:25 +02:00

customer_ghost_delete_render_test.go

hub v0.70.1: the ghost customer's Delete button must exist (Danger-zone render gate split)

2026-07-22 09:23:37 +02:00

customer_reset_render_test.go

hub v0.61.0 + felhom-tenantsync v1.1.0: Customer RESET (middle lifecycle tier)

2026-07-17 13:09:04 +02:00

customer_reset_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

customer_reset.go

feat(hub): v0.70.0 — a deleted customer actually disappears (residue leg + ghost cleanup)

2026-07-21 20:28:06 +02:00

customer_state_banners_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

customer_tabs_test.go

hub: merge the customer edit page into the Edit tab (v0.48.0 edit-a, part 2)

2026-07-12 17:33:07 +02:00

declared_floor_test.go

hub v0.112.0: a floor carries a declared MinAgent past the golden (R-472)

2026-09-13 16:47:11 +02:00

dr_recipe.go

…

drtier_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

embed.go

…

escrow_demote_wording_test.go

hub v0.60.1: host deletion demotes escrow custody (never destroys) + customer-delete purge point + S6b obsolete

2026-07-17 11:25:38 +02:00

floor_ui_test.go

hub v0.82.0 (R-120): the vouch path REFUSES a golden the fleet has already outrun

2026-07-30 10:42:43 +02:00

funcmap_test.go

…

hosts_delete_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

hosts_guestnet_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

hosts_network_test.go

hub v0.85.0 — Network card: a host's addresses are visible at last

2026-07-31 08:49:44 +02:00

hosts_recovery_reveal_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

hosts_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

hosts.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

logbundle.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

logtail.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

offsite_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

offsite_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

offsite_default_test.go

hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

2026-09-16 16:56:01 +02:00

offsite_test.go

…

offsite.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

os_updates.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

passphrase_handover_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

pbsdr_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

pbsdr_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

pbsdr_generation_test.go

hub: R-39 core — stamp a secret GENERATION into the pbs_dr descriptor

2026-07-21 09:52:04 +02:00

pbsdr_poke_test.go

hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

2026-07-17 17:30:41 +02:00

pbsdr_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

pbsdr.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

r133_reveal_wrongkey_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r135_csrf_test.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

r136_host_cookie_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

r276_host_delete_wg_test.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

r277_r92_bytes_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r283_box_claim_test.go

R-283: customer page shows the box's own claim state beside the hub's, and warns on a mismatch

2026-10-05 21:45:04 +02:00

r292_artifact_flash_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r331_backup_card_test.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

r349_agent_binary_test.go

R-349 (hub half): host page shows agent-binary drift from the reported agent_sha256

2026-10-05 21:45:04 +02:00

r508_no_email_banner_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r544_r599_host_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r604_floor_held_back_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r725_bind_expired_copy_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r728_create_once_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

refresh_cachebust_test.go

hub: scoped auto-refresh + style.css cache-bust + staging rule (v0.48.0 parts 3-4)

2026-07-12 17:37:04 +02:00

render_test.go

hub: delete the host-install version label (R-94) + invert hostinstall gate 1

2026-08-02 15:16:01 +02:00

rollup_test.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

rollup.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

selfbind_automint_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

selfbind_mint.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind_naming_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_resend_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

selfbind_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_waiting_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

server.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

system_bundle_test.go

hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

2026-10-04 20:18:37 +02:00

system_test.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

system_trim_test.go

R-444: hub half — the System page shows each box's last disk trim

2026-10-06 11:29:17 +02:00

system.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

templatefetcher.go

…

version.go

…

wrapper_drift_test.go

hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

2026-07-21 10:01:35 +02:00