admin 5beedcce1a R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated ...

Unreleased; ships with tomorrow's hub release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-08 10:09:20 +02:00

..

testdata

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

appliance_test.go

…

appliance.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

artifact_test.go

…

backup_run_digest_event_test.go

…

backup_target_event_test.go

…

chaosnight_events_test.go

hub v0.123.0: app_stopped_unhealthy (decision 28); 09 decisions 26-28 recorded

2026-09-24 11:38:13 +02:00

claim_ack_test.go

…

config_version_ack_test.go

…

controller_supervisor_event_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

crash_test.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

crash.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

desired_test.go

…

dr_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

dr.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

escrow_get_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

escrow_repo_key_changed_test.go

…

escrow_retained_get_test.go

…

escrow_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

event_test.go

…

floor_ack_test.go

…

handler.go

R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

2026-10-08 10:09:20 +02:00

host_enroll_test.go

…

host_recovery_test.go

…

host_test.go

…

logbundle_ack_test.go

…

logtail_ack_test.go

…

mail_test.go

…

mail.go

…

managed_floor_ack_test.go

…

offsite_test.go

hub v0.129.0: operator raises ONE clean-up window's cap (R-833); restore-beside script + runbooks (R-834)

2026-10-04 08:56:56 +02:00

offsite.go

hub v0.128.0: set-aside deletion through the hub after a 7-day wait (decision 74, R-823), key-file clean-up route (R-826), read-only key check (R-827), window cap = half

2026-10-04 07:05:21 +02:00

os_updates_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

os_updates.go

hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

2026-10-04 10:56:39 +02:00

pbsdr_test.go

…

pbsdr.go

…

poke_seam_test.go

…

preferences_guard_test.go

…

r262_restoretest_subset_test.go

burn-down Part B: 14 small rows fixed and closed across four repos (306 -> 292); no :latest in the hub build; gate list pinned; closed-id duplicates refused; R-262 subset pinned

2026-10-05 17:10:38 +02:00

r304_older_package_event_test.go

R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

2026-10-08 10:09:20 +02:00

r330_smart_counters_test.go

R-330: the hub models SMART 187/188/199 in the host-report (G-1; nothing alarms on them yet)

2026-10-06 22:03:49 +02:00

r366_foreign_key_archives_test.go

R-366 slice 2 (decision 168): one operator line when the box's whole-guest archives include another key's (edge-triggered)

2026-10-07 10:21:25 +02:00

r387_severity_visibility_test.go

hub v0.107.0: the hub rewrote a severity and said nothing (R-387); golden 0.223.0

2026-08-23 11:57:26 +02:00

r871_catchup_event_test.go

hub v0.134.0: a down box is judged on longer missed-backup lines (R-872); household outage mail at most weekly (R-873); backup_catchup_done allowed (R-871)

2026-10-05 09:24:14 +02:00

r879_box_seal_test.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

recovery_unit_event_test.go

…

tunnel_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

wait_test.go

…

wait.go

…

wg_test.go

…

wg.go

…

whole_guest_event_test.go

…