admin 368ee9878d hub v0.153.0: no token sends, mints or reveals a household credential or link (operator ruling 13:20, 09 §3 decision 252) ...

- Session only: claim-resend, customer create, customer edit (changes the e-mail), create-config; pinned with
  selfbind-link, regen-password, appliance bind by TestToken_CredentialAndLinkRoutesAreSessionOnly (red-proved x2).
- Customers write keeps block/unblock/geo. R-1055 closed; R-1059 filed (off-site re-issue, operator decision).
Not deployed — waits for the operator's yes.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

2026-10-15 13:26:05 +02:00

..

static

D4 Part 1: hub fonts + sprite + statusColor semantic remap

2026-07-02 22:34:40 +02:00

templates

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

appliances_test.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

appliances.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

apps_render_test.go

hub v0.43.0: remote app-log diagnostics — copyable issues + context + on-demand log tails + range/dismissal fixes

2026-07-10 16:03:32 +02:00

apps.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

artifact_choices_test.go

hub v0.101.0 — memoise the artifact dropdown for 60s (R-267, operator ruling)

2026-08-08 20:08:51 +02:00

artifact_installability_test.go

hub v0.102.0 — refuse to vouch a version that cannot be installed (R-273)

2026-08-09 19:13:45 +02:00

artifacts_form_render_test.go

hub v0.68.1 — fix the Configuration layout broken by the wrapper-sha field

2026-07-21 10:34:34 +02:00

backup_card.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

bind_language_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

change_password_test.go

@

2026-07-13 22:46:49 +02:00

claim_ui_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

configs_debug_test.go

R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129

2026-10-08 10:19:39 +02:00

configs_delivery_render_test.go

hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

2026-07-23 12:59:04 +02:00

configs_offsite_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

configs.go

hub R-138: the token's one zone must BE the customer's domain (order-independent; security review)

2026-10-08 15:17:05 +02:00

controller.yaml.default

hub v0.50.0: customer-claim arc docs (CHANGELOG, default template claim_code_* fields, REUSE rows)

2026-07-12 18:45:43 +02:00

customer_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_delete.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

customer_edit_tab_test.go

R-32 (decision 167): RESET purges the off-site folder through the sub-account's own login before deleting it

2026-10-07 10:21:25 +02:00

customer_ghost_delete_render_test.go

hub v0.70.1: the ghost customer's Delete button must exist (Danger-zone render gate split)

2026-07-22 09:23:37 +02:00

customer_reset_render_test.go

hub v0.61.0 + felhom-tenantsync v1.1.0: Customer RESET (middle lifecycle tier)

2026-07-17 13:09:04 +02:00

customer_reset_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

customer_reset.go

feat(hub): v0.70.0 — a deleted customer actually disappears (residue leg + ghost cleanup)

2026-07-21 20:28:06 +02:00

customer_state_banners_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

customer_tabs_test.go

hub: merge the customer edit page into the Edit tab (v0.48.0 edit-a, part 2)

2026-07-12 17:33:07 +02:00

declared_floor_test.go

hub v0.112.0: a floor carries a declared MinAgent past the golden (R-472)

2026-09-13 16:47:11 +02:00

deliberate_off_view_test.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

dr_recipe.go

hub v0.13.0: DR recipe — assemble + store + view the secret-free reconstruction recipe

2026-06-16 18:49:45 +02:00

drtier_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

embed.go

D4 Part 1: hub fonts + sprite + statusColor semantic remap

2026-07-02 22:34:40 +02:00

escrow_demote_wording_test.go

hub v0.60.1: host deletion demotes escrow custody (never destroys) + customer-delete purge point + S6b obsolete

2026-07-17 11:25:38 +02:00

floor_ui_test.go

hub v0.82.0 (R-120): the vouch path REFUSES a golden the fleet has already outrun

2026-07-30 10:42:43 +02:00

funcmap_test.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

hosts_delete_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

hosts_guestnet_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

hosts_network_test.go

hub v0.85.0 — Network card: a host's addresses are visible at last

2026-07-31 08:49:44 +02:00

hosts_recovery_reveal_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

hosts_test.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

hosts.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

logbundle.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

logtail.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

mailhold_test.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

offsite_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

offsite_box.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

offsite_default_test.go

hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

2026-09-16 16:56:01 +02:00

offsite_integrity_line_test.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

offsite_test.go

hub: offsite multi-endpoint management UI (v0.47.0 part 5)

2026-07-11 21:35:24 +02:00

offsite.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

opactions_test.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

opactions.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

os_updates.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

passphrase_handover_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

pbsdr_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

pbsdr_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

pbsdr_generation_test.go

hub: R-39 core — stamp a secret GENERATION into the pbs_dr descriptor

2026-07-21 09:52:04 +02:00

pbsdr_poke_test.go

hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

2026-07-17 17:30:41 +02:00

pbsdr_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

pbsdr.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

r30_presence_delete_test.go

hub: box presence from the wait channel + delete a switched-off box at once (R-30, D2)

2026-10-08 15:17:05 +02:00

r133_reveal_wrongkey_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r135_csrf_test.go

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

r136_host_cookie_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

r138_cf_token_reach_test.go

hub R-138: the token's one zone must BE the customer's domain (order-independent; security review)

2026-10-08 15:17:05 +02:00

r276_host_delete_wg_test.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

r277_r92_bytes_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r283_box_claim_test.go

R-283: customer page shows the box's own claim state beside the hub's, and warns on a mismatch

2026-10-05 21:45:04 +02:00

r292_artifact_flash_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r331_backup_card_test.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

r349_agent_binary_test.go

R-349 (hub half): host page shows agent-binary drift from the reported agent_sha256

2026-10-05 21:45:04 +02:00

r415_domain_conflict_test.go

R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129

2026-10-08 10:19:39 +02:00

r508_no_email_banner_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r544_r599_host_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r604_floor_held_back_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r725_bind_expired_copy_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r728_create_once_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

refresh_cachebust_test.go

hub: scoped auto-refresh + style.css cache-bust + staging rule (v0.48.0 parts 3-4)

2026-07-12 17:37:04 +02:00

render_test.go

hub: delete the host-install version label (R-94) + invert hostinstall gate 1

2026-08-02 15:16:01 +02:00

rollup_test.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

rollup.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

routes.go

hub v0.153.0: no token sends, mints or reveals a household credential or link (operator ruling 13:20, 09 §3 decision 252)

2026-10-15 13:26:05 +02:00

selfbind_automint_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

selfbind_mint.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind_naming_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_resend_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

selfbind_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_waiting_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

server.go

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

system_bundle_test.go

hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

2026-10-04 20:18:37 +02:00

system_layout_test.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system_test.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

system_trim_test.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system_view.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

templatefetcher.go

fix: update repo-name refs after deploy-felhom-compose -> felhom-controller rename

2026-06-08 14:03:13 +02:00

tokens_test.go

hub v0.153.0: no token sends, mints or reveals a household credential or link (operator ruling 13:20, 09 §3 decision 252)

2026-10-15 13:26:05 +02:00

tokens.go

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

version.go

feat: add controller update trigger + version checker (v0.1.8)

2026-02-19 18:16:38 +01:00

wrapper_drift_test.go

hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

2026-07-21 10:01:35 +02:00