felhom.eu/REPORT-drill-fresh-install-0242.md

REPORT — DRILL: a stranger's first hour on 0.242.0 (2026-09-14)

Runbook-style validation. No product code written. A parallel session owns root REPORT.md, so this is a topic sibling (CLAUDE.md). Findings doc: documentation/audits/DRILL-fresh-install-0242-2026-09-14.md; every observable: documentation/audits/evidence-drill-fresh-install-0242-2026-09-14/journal.md.

0. Claims in the brief that turned out wrong, or incomplete — named first

1. "ep0 is not touched." Enrolment itself registers a WireGuard peer on ep0 for every box (wg registered … ip=10.77.0.5/32 … sync=ok), DR tier on or off. I avoided the part I could (DR tier off, which would have created an ep0 namespace and token); the peer is the product's own act and is removed by the host delete (§5).
2. "This run re-proves or narrows the journey row (~L90)." That row is the rebuild-and-recover journey (walk 5). This drill walked the first hour, with off-site off. It can neither re-prove nor narrow that row. I added a scope note to it and a new first-hour row (PARTIAL).
3. "Claim the box with the code." There are three secrets, not one: the console Párosító kód, the operator-held Tulajdonosi jelmondat (nothing delivers it — R-497) and the mailed Beállító kód. Two of the three arrive by mail, which this harness cannot read.
4. The three claims marked "read, not measured" — measured now: website — true, no mention of the installer or iso.felhom.eu, and the ISO host has no index; instructions — true, none exist (R-493); golden landing — the box landed on 0.242.0, the new golden, with no self-update.
5. "Newest baked golden 0.236.0; waiver to 2026-09-27; highest R-492; baselines" — all correct.

1. Baselines (re-verified 12:58 UTC)

controller 406755fa8fba v0.242.0 · agent 4586f0f7f6d1 v0.130.0 · felhom.eu 41590f8ee618 hub v0.112.0. Hub before: agent 0.130.0, golden 0.236.0, min_agent 0.129.0, floor 0.242.0. Architecture read for the area: 00-capability-map.md (journey row), 09-update-architecture.md §3.

2. The golden

0.242.0 baked, round-trip verified, vouched — sha 3ab480dd…e6d8, 653 288 425 B, all markers pass, token-leak 0 with a working control, three readers agree. Only golden_version moved. documentation/tests/golden-0.242.0-2026-09-14/README.md. The golden-currency gate is now plain OK. One slip: my first template pick was arm64; caught before the bake.

3. The verdict

Interventions: 1. Ready for a volunteer: no — no instructions exist (R-493), and the setup mail's dashboard link does not open for a new customer (R-494). Every mechanism after that passed: install, landing on the vouched set, deploy, use, backup, remove, byte-identical restore, power cut (same versions, no alarm), code typo and lockout.

intervention	row	what
I1	R-494 (filed before acting)	dashboard reached by LAN address with the name forced — the mailed name has no DNS

Harness substitutions (a volunteer would not need them; each hides a part of the path): H1 no mailbox → operator bind instead of the self-bind page, and two box-printed setup codes via the vaulted break-glass; H2 US keyboard layout; H3 auto-reboot unticked, ISO detached; H4 Terminal UI entry. Full list with harness slips: findings doc §3.

4. Findings — every one a row

row	rank
R-493	P1	no customer install instructions; ISO host has no index
R-494	P1	new customer's dashboard has no address (I1)
R-495	P2	installer's unanswered questions; refuses its own default hostname
R-496	P2	console sends a stranger to the Proxmox admin page; „a jelszavadat"
R-497	P2	the Tulajdonosi jelmondat is delivered by nothing
R-499	P2	„already in the PBS backup, nothing to do" on a box with no PBS
R-498	P3	52 of 53 app pages say literal wiki.DOMAIN
R-500	P3	dashboard backup time in UTC, backup pages in local time

R-469 was not touched. R-214 reproduced (recorded, row unchanged). Register: 200 → 208 table rows. Opened 8, closed 0.

5. Teardown — three layers

layer	before	after
1. machine	qm list: VM 330 running, 8.6 G in /mnt/hdd_1/images/330	qm destroy 330 --purge → qm list empty; images/330 gone; images/9202 untouched
2. host	nvme-scratch used 19 059 372 KiB · local used 24 768 200 KiB · ISO present · /root/drill0242 40 files	nvme-scratch 10 130 532 KiB (≈8.5 GiB returned) · local 23 013 832 KiB (the 1.7 GiB ISO) · ISO 0 · scratch dir shredded and removed. nvme-scratch storage itself stays — it hosts 9202. vmbr9 pre-existed
3. hub	customer drill0242, host drill0242-3f4b42 ONLINE, deletable:false, wg_peer_bound:true, recovery_present:true	PENDING — see §5b

5b. The hub record

(Filled in when the host has aged to stale and the delete cascade has run.)

Append-only and staying, by design: the hub's event stream (controller_started, app_removed, claim_lockout, the bind and enrol lines) and the operator e-mail for the lockout.

Untouched, and checked: demo-hp guests 9201 and 9202 (running before and after); local-lvm (44.17 % before and after); demo-felhom; DooPlex services (the bake VM, the accepted exception, back on virgin); Peti's box; ep0 beyond the product's own peer. drill-r50 does not exist (R-461).

6. Secrets

Hub password, BookStack and dashboard passwords, the passphrase, both setup codes, the break-glass credential and the installer root password lived only in 0600 files in the session scratchpad. Every committed file was swept for each, with a planted control that was found: 0 hits. The pairing code is redacted in two screenshots and the text. The break-glass reveal emitted its audit event, by design.

7. unproven.py --summary

Unchanged: 55 claims, NOT WALKED 35 of 55. It reads its own claim list, not the new map row.

8. Observations

• The deploy page's poll has no degraded branch; 16 s of stale step text on BookStack.
• The drive-attach list offers the guest's own system volume as an existing drive.
• The removal dialog names „éjszakai restic pillanatképek" on a box with no restic.
• „0 °C" beside „Nincs adat" for a virtual disk; an English „Debug" menu item.
• The claim lockout is global as well as per source; its mail reaches the operator only.
• Two of my first readings were of script-rendered elements from server HTML (host-metrics banner, restore-finish message); both corrected in the journal. No browser here — strict UI coverage is the operator's click-through.