admin
01d5dbd3e0
gates / gates (push) Successful in 2m43s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
30 lines
2.2 KiB
Markdown
30 lines
2.2 KiB
Markdown
# 2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the update ladder (R-890, R-891)
|
|
|
|
Rulings: `09` §3 decisions 149 (the admin seed on the test boxes) and 150 (instruction files kept true by the session).
|
|
|
|
## Part B — vaultwarden 1.36.0-alpine → 1.37.4-alpine, both venues
|
|
|
|
| venue | result | file |
|
|
|---|---|---|
|
|
| bench LXC 9401 (demo-hp), harness v5, `FELHOM_BENCH_ADMIN_SEED=1`, 600 s memory watch | **proven**: seed read back before and after, healthy in 30.9 s, anon peak 16.3 % (cgroup 22.3 %), 0 kills, 0 restarts, no file changed | `bench/R890-vw.log`, `bench/evidence/MV-vaultwarden/verdict.json` |
|
|
| scratch guest 9202 (drill catalog), `FELHOM_BOX_ADMIN_SEED=1` | **proven**: a fresh install; self-registration 400 (closed by design); the admin sign-in and invite INSIDE the box → (200, session yes, 200); invited registration 200; seed read back; the guarded Update backing-up → pulling → copying → verifying → done in 12.3 s; seed read back; badge „Frissítés elérhető — 80 napja" before, „Naprakész" after; removed through the product (no container, no volume left) | `box/vaultwarden/step.txt`, `box/vaultwarden/box-verdict-vaultwarden.json`, `box/run.out` |
|
|
|
|
Written to the live catalog by `upgrade-test.py --write-ladder` (catalog `ecb8552`). The tool: `tools/vwstep.py` (one
|
|
process, so the install and the seed are the same run — the guard requires that). 9202 pointed at the drill:
|
|
`box/C1-repoint-drill.txt`.
|
|
|
|
**Secrets:** the admin token was never on DooPlex — the box read it from the container's environment and handed it to
|
|
curl on stdin; only HTTP codes came back. Scan of `bench/` and `box/` for 48+ hex characters, `VW_ADMIN=` and
|
|
`ADMIN_TOKEN=` values: 0 hits; control: a fresh 64-hex line → 1 hit. The bench's run `.env` is gone (shredded by the
|
|
harness); the bench has 0 containers and is stopped.
|
|
|
|
## Part C
|
|
|
|
- R-644: `C/R-644-9202-live.txt` — no gokapi on 9202 any more.
|
|
- R-763 / R-764 / R-762: `C/wger.txt` (`tools/wgerwalk.py`; wger un-hidden in the DRILL only, removed after).
|
|
|
|
## Teardown
|
|
|
|
`box/T1-repoint-live.txt` (9202 back on the live catalog, byte-identical `controller.yaml`; the same six containers),
|
|
`box/T2-drill-reset.txt` (drill = live).
|