46 lines
3.0 KiB
Markdown
46 lines
3.0 KiB
Markdown
# REPORT — the four evening items before the second night (2026-09-13)
|
|
|
|
*Overwritten each session. The night's own report (adventurelog rotation, v0.240.0) is preserved as
|
|
`audits/nightly-2026-09-13-adventurelog/` and the register; the controller report is
|
|
`felhom-controller/REPORT.md`, the catalog's `app-catalog-felhom.eu/REPORT.md`.*
|
|
|
|
## 1. The rules file
|
|
|
|
`.claude/rules/unprompted-work.md` copied byte-identical into `felhom-controller`, `felhom.eu` and
|
|
`app-catalog-felhom.eu` (documents-only pushes). `instructions_gate.py` refused the first push: a rule
|
|
file needs `paths:` or `unconditional: true`; all four copies (root included) now start with the
|
|
three-line `unconditional: true` frontmatter — sha256 `d1aa3af83ae3b220…` everywhere.
|
|
|
|
## 2. R-481 — the scratch guest (ruled; NOT built, and why)
|
|
|
|
The ruling ("a second enrolled LXC … enrolled as a scratch customer") collides with the model: the hub
|
|
keys a host to one customer (`hosts.host_id` PK) and the box runs one agent with one host identity;
|
|
re-running the installer with another customer-id would rewrite demo-hp's enrolment. Options and a
|
|
recommendation are in the row and STATUS; 9201's shape and the disk placement (`pct move-volume`
|
|
onto a `dir` storage at `/mnt/hdd_1`) are recorded for whichever is chosen.
|
|
|
|
## 3. R-483 — photos (re-ranked P2, catalog)
|
|
|
|
Diffed against `homelab-manifests` `adventurelog-system/adventurelog.yaml`: the k3s ingress sends
|
|
`/media`, `/static`, `/admin`, `/accounts` to the backend **service port 80**; the catalog sent
|
|
everything to the frontend. Two catalog cuts (`3172258`, `ed62cfd`): a backend traefik router for the
|
|
four prefixes, then port 80 instead of 8000 — the backend image runs nginx in front of gunicorn and
|
|
Django serves a photo by `X-Accel-Redirect`, so port 8000 returned 200 with an empty body. Applied to
|
|
the operator's own instance through the guarded Update; proven without a browser
|
|
(`audits/nightly-2026-09-13-adventurelog/11-R483-repro.txt`): `GET /media/images/<id>.webp` with a
|
|
session → 200 `image/webp`, RIFF/WEBP magic; anonymous 403 (the app's rule). **Confirmed by the operator in a browser at 21:49 — closed.** The frontend's 500 on scripted multipart uploads is upstream and
|
|
recorded in the row; browser uploads work.
|
|
|
|
## 4. R-479 — tier order for bind-data apps (ruled; controller v0.241.0)
|
|
|
|
Ruling 9 in `09-update-architecture.md` §3. Built, tested, red-proofed; delivered by the floor and
|
|
live-checked on a nextcloud throwaway — see `felhom-controller/REPORT.md` and
|
|
`audits/v0241-2026-09-13/`.
|
|
|
|
## Observations
|
|
|
|
0. **A removed app keeps its update hold; a reinstall would start held.** FILED: R-491
|
|
|
|
1. **The controller's evening release rides the same session as the night's — two releases in one calendar day, one per session.** NOT-A-FINDING: the rule is per session; both are recorded with their MinAgent lines.
|
|
2. **`homelab-manifests` is not in the workspace; its manifests were read from Gitea's API.** NOT-A-FINDING: the workspace CLAUDE.md says non-felhom repos are unrelated; a read-only fetch was enough.
|