admin
2c48feb325
gates / gates (push) Successful in 5m45s
Found while publishing the legal pages: a background security review flagged
the <!-- source --> comments served in website/adatkezeles.html. Chasing what
those comments point AT found something larger.
MEASURED, and the control is what makes it mean anything:
- manifest_bearer_gate.py itself prints
"manifests/felhom.secret.yaml:39 KNOWN-BACKLOG committed secret"
- that file holds live-shaped values, not placeholders: SECRET_KEY (69),
SUPERUSER_PASSWORD (18), Umami APP_SECRET (66) and POSTGRES_PASSWORD (34),
plus a username/password pair. Values were never printed, only measured
by length.
- gitea.dooplex.hu resolves to 37.191.56.193, the website's public address
- anonymous curl: 200 and 1686 bytes for that file; 200 for hub internals
- OFF-NETWORK CONTROL: fetched from outside the operator's network, a real
path returns the file's first line and a nonsense path returns 404. So
the 200 is genuine anonymous read from the internet, not a LAN-only ACL.
This contradicts documentation/runbooks/secrets.md:3-4, which states secret
values are never committed and the manifests carry only placeholders. That
promise is false today.
Ranked P2, not P1, and the row says why so the operator can overrule: the
exposed credentials guard analytics and an undeployed healthchecks instance,
NOT household data. Measured: umami-db is a ClusterIP service with no
external IP, so the Postgres password is not internet-reachable. No customer
box, hub token or escrow key is in the file.
NOTHING WAS CHANGED. Making the repo private could break the public day-0
installer path (R-110), and rotation plus repo visibility are operator
decisions on production infrastructure. The row carries the order: rotate
first (de-git alone kills nothing — the runbook says so), then decide
visibility, then CC does the de-git and tightens the gate.
Coupled and easy to miss: the 32 source comments on /adatkezeles are harmless
while the repo is public, but become a map of it the moment it is private, so
that is one change and not two. Their traceability is already kept in
documentation/legal/*-1.0.md.
documentation/backlog/
OPEN-ITEMS.md is the register of open work and the file to read first — it holds only what is
open, one row per item, every row with a category, a severity, a state and an owner (the layout is at its
top). CLOSED-ITEMS.md holds every finished row, compressed, with the commit that keeps its full text;
a row moves there in the same commit that closes it (scripts/closed_register_gate.py RULE 3).
ROADMAP.md holds intentions — features and spikes that do not exist yet — and ROADMAP-HISTORY.md
the shipped and killed ones. An R-n id is minted once and never reused.
The other files in this folder — verdict per file (2026-10-03 triage)
| File | Verdict |
|---|---|
SPEC-app-data-placement-2026-08-21.md |
KEEP — still referenced by open rows R-352 (placement still open) and R-368. |
SPEC-r85-phase4-5-2026-07-26.md |
KEEP as history — a spec of shipped work (R-85, agent v0.104.0). CONTEXT.md and architecture/00-capability-map.md link here. |
FOLLOWUP-nas-automount-guest-reboot-reassert.md |
FINISHED, kept in place — shipped in agent v0.84/v0.85 (CAMPAIGN-3). Not moved because CONTEXT.md, controller/network-storage-nas.md and felhom-controller/CONTEXT.md link to this path. |
Moved to documentation/archive/ on 2026-10-03 (finished; nothing open refers to them):
FIX-M18-NOTES.md— dump re-validation every 5 min. FIXED in controller v0.62.0 @f8afe5c(2026-06-14).FIX-M19-NOTES.md—deriveStackNamemisattribution edge. FIXED in controller v0.62.0 @6bab68b(2026-06-14).FOLLOWUP-golden-default-controller-tag.md— the golden baked a stale controller. FIXED in felhom-agent @ceca355(2026-07-03):build-golden.shv2.0.0 makes the controller tag a mandatory argument. Evidence:../audits/DRILL-golden-098-2026-07-03.md.DIAGNOSIS-f9-storage-registration-gap-2026-06-14.md— a read-only diagnosis of June 2026, superseded by the shipped F9 fixes (controllerCHANGELOG.mdcites it as history).
The archive also holds OPEN-ITEMS-narratives-2026-10-03.md: the campaign write-ups, rulings and ranking
paragraphs that sat between the register's tables until the triage, word for word.