Files

T

admin 671bd3fd91 CAMPAIGN-6B: note credential fully reverted at cleanup

Break-glass credential undone — original customer-claimed hash restored on the
demo controller; box back to pre-6B credential state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A45Qop8YY8tS94bz63LFne

2026-07-14 13:32:14 +02:00

3.0 KiB

Raw Blame History

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

CAMPAIGN-6B — unattended close-out of the C6 remainder — 2026-07-14

controller 0.129.0 / agent 0.88.0 / hub 0.54.0 · demo + drill · findings-only, unattended

Continuation of CAMPAIGN-6A. Drove the .fab full-circle (upload/download + real Cloudflare edge), the server-observable browser/DOM planes, backup-tier + NAS integrity, and regression spot-checks. Full audit: documentation/audits/CAMPAIGN-6B-2026-07-14.md. Continuation: CAMPAIGN-6C-2026-07-14-PROMPT.md.

Headline finding — C6B-F1 (CRITICAL)

.fab export silently produces hollow, data-free bundles for the standard ${USERDATA_PATH} needs_hdd app convention — 12 of 13 media catalog apps (jellyfin, plex, emby, immich, sonarr, radarr, navidrome, paperless-ngx, audiobookshelf, calibre-web, komga, romm). Live: sonarr with 4.17 GB / 7 files exported to a 2308-byte, config-only bundle, reported done with no error, past the v0.125.0 anti-hollow guard. Two compounding causes in the needs_hdd branch: executeExport is either/or (needs_hdd apps never run exportVolumeData, dropping named volumes incl. the app DB), and ParseComposeHDDMounts substitutes only ${HDD_PATH}, never ${USERDATA_PATH} → 0 mounts → all userdata skipped. The guard only checks manifest-claimed tars, so 0-claimed passes. .fab is the customer portability/backup-download path → fresh/cross-box restore = silent total data loss. Fix direction in the audit; priority for project Claude to spec.

What passed

.fab transport is byte-clean end-to-end — LAN + real Cloudflare edge, upload (64 MiB chunked) and download, every sha256 == reference.
413 edge-cap re-proven (120 MiB → CF 413 before origin; 80 MiB clears to origin).
Upload state machine 8/8 — wrong-ext 400, collision (N), single-flight 409, strict-offset 409, abort cleanup, oversize (both Hungarian numbers), restart-GC, idle-15min expiry.
F7 atomicity (.tar.tmp→rename) code-confirmed; native alert()/confirm() absent on all surfaces; CSRF stale → 403, session-expiry → 401-JSON/redirect; F4 uid-range friendly 400; agent-restart per-share re-arm verdicts logged.

Split to CAMPAIGN-6C

Supervised browser planes (escrow wizard click-through, hub 8-tab UX); deep backup tiers (live F7 6 s-cut, restic self-heal, offsite restore-to-verify, tier-2 F6, per-app toggles, snapshot coherence); dead-app alert + email cooldown; the C6B-F1 fix-verify full-circle byte-compare.

Notes

No code changed. A temporary break-glass credential was used on the demo controller to drive the authed tests, then fully reverted at cleanup (original customer-claimed hash restored) — the box is back to its pre-6B credential; Viktor rotates that. No secret/R/blob committed.

3.0 KiB Raw Blame History