admin
3159892fab
gates / gates (push) Successful in 27s
- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202 through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today. - Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored — two wiring faults found live on 9202); floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger. - Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK. - Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446. - register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red. Evidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/. Report: REPORT-night-rulings-2026-09-30.md. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
3.6 KiB
3.6 KiB
STATUS — what works, what's broken, what's next
Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).
Updated 2026-09-30 (late evening). Both demo boxes run controller 0.284.2 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.284.2 with agent 0.138.0.
Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.
Your two decisions of tonight — built
- Security fixes under the same name (your A). The catalog can now re-test a database image's new fix and record it as a tested step. A box then takes it at night by itself. Tested from start to end on the scratch box: the night run took the fix, the app kept its data, and the page went back to "up to date". Today there was nothing to re-test for the database and redis images.
- Old program files on the disk (your A). A box now keeps each app's current program and the one before it, and deletes the older ones. It never deletes one that another app still uses. On the first start it cleaned up once: the HP demo box freed 11 GB, the scratch box 21 GB. All apps kept running.
What else I did, and it worked
- The short login risk is closed. After an install, an app with a known default password is now closed to strangers until the box has changed that password. Tested on two apps: no stranger got in.
- wger's phone app can log in now (its missing key is made at the first start).
- New controller 0.284.2 is on both demo boxes, and a new golden 0.284.2 is baked and vouched. The golden check is green (not just waived).
What broke, and what I did
- The clean-up first missed most images. Two mistakes, both found on the scratch box before any demo box got the release: it did not run on the Remove button, and it could not see images stored without a name. Both fixed and tested. That is why the version is 0.284.2 (0.284.0 and 0.284.1 never went out).
- wanderer can now run on the test bench, but its update is not tested yet: I could not create test data in it. Also found: its search engine needs one extra setting before any update, or it refuses to start.
- Two exact versions were rebuilt by their makers under the same name (nextcloud and sonarr). The monthly re-test finds them. Tonight I only did the database images, as you ruled.
- mealie locks the account after five wrong passwords — also when a stranger types them. Written down.
- Old controller versions still pile up on each box (about 50). Your rule covered apps only. Written down.
Rows. Tonight: 5 closed, 3 narrowed, 6 opened. The list went from 377 to 383 rows (counted with every row, including three whose number has a letter — the old check skipped those).
What needs you
- Who presses the monthly re-test? It is one command, but it needs the test bench and the scratch box set up first, so it cannot run by itself (the steps are written down). Options: CC does it in a monthly session, or you start it. If nobody presses it, same-name security fixes wait until the next time we move that app.
- Should the monthly re-test cover every app, or only databases? Exact versions get rebuilt too (nextcloud, sonarr). If you do nothing, only databases are re-tested.
- Old controller versions: keep only the current and the previous one? If you do nothing, about 150 MB per release keeps piling up.
- No golden bake is due — tonight's bake carries the newest controller.
Standing steps
- Monthly: the same-name security re-test (runbook
monthly-floating-retest.md). - Weekly: the golden bake (around 7 October).