admin 7e57e824a2 hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace ...

app_held / app_hold_cleared allow-listed and operator-only; handleEvent mirrors them in held_apps; HeldAppsChecker
sends ONE app_held_reminder (warning, operator-only, per-app cooldown) after the grace per reason (6 h / 1 d / 3 d),
then weekly; recorded before sending; stale rows not reminded; the hub never clears a hold. Test-only
alerting.held_app_grace_override. TestD53_* in api/monitor/notify/web, red-proved by six mutations. Commit only.

2026-10-26 18:25:00 +01:00

..

testdata

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

appliance_test.go

hub v0.62.0 + scripts v1.19.0 — R-21 slice C: the universal secret-free ISO

2026-07-17 15:07:31 +02:00

appliance.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

artifact_test.go

hub v0.16.0 + host-install v1.1.0: Day-0 artifact manifest + self-install the agent (BUNDLE slice)

2026-06-28 08:38:26 +02:00

backup_run_digest_event_test.go

hub v0.90.0 — a dropped notification leaves a trace, and the backup digest arrives (R-182)

2026-08-03 13:46:48 +02:00

backup_target_event_test.go

hub v0.81.0 — E-2: backup_target_absent gets its own signal (ships first)

2026-07-29 07:55:18 +02:00

chaosnight_events_test.go

hub v0.150.0: app_repaired_after_crash — allow-listed + operator-only, counts line in the operator mail (R-1007); decision 236 recorded

2026-10-14 16:58:35 +02:00

claim_ack_test.go

hub: F-15 instant reset codes — reset-request response carries the rotated {code_hash, generation, issued_at} (same shape/guarantee as the report ACK); claim-resent flash now states the operator-resend ACK lag

2026-07-13 08:04:53 +02:00

config_version_ack_test.go

hub v0.26.0: pull-based config delivery + retire inbound GUI controls

2026-06-30 21:49:33 +02:00

controller_supervisor_event_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

crash_test.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

crash.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

crossbox_refusal_test.go

hub (tests only): five cross-box refusal tests (security review part 3); R-955 filed (100 -> 101 rows)

2026-10-12 17:06:51 +02:00

crosscustomer_prefs_test.go

hub (unreleased, SECURITY): /preferences and /notify refuse a per-customer key acting for another household (403); red-proved

2026-10-09 12:48:54 +02:00

customers_auth_test.go

hub v0.148.0 (code): SECURITY — the customer list and box reports need the operator key (R-951); R-950 rotated; R-952, R-953 filed (97 -> 99 rows)

2026-10-12 16:51:42 +02:00

d53_held_apps_test.go

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

deliberate_off_test.go

Hub v0.149.0: clamp a future deliberate-off time; hold a customer only when all its hosts are off (R-998)

2026-10-13 19:52:12 +02:00

deliberate_off.go

Hub v0.149.0: clamp a future deliberate-off time; hold a customer only when all its hosts are off (R-998)

2026-10-13 19:52:12 +02:00

desired_test.go

slice 10B: signed-op job completion (DELETE clear-job) (hub v0.10.0)

2026-06-10 20:14:32 +02:00

dr_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

dr.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

escrow_carry_test.go

hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

2026-10-21 13:36:45 +02:00

escrow_carry.go

hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

2026-10-21 13:36:45 +02:00

escrow_get_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

escrow_repo_key_changed_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

escrow_retained_get_test.go

hub v0.103.0 — a host can read the packages we kept for it (R-311)

2026-08-12 18:43:07 +02:00

escrow_test.go

R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

2026-10-07 10:21:25 +02:00

event_test.go

hub v0.73.1: allowlist disk_health_degraded (controller v0.169.0 disk-health)

2026-07-24 21:35:01 +02:00

floor_ack_test.go

hub v0.15.0: Phase 2 managed updates — per-customer controller-version floor

2026-06-27 11:59:30 +02:00

handler.go

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

host_enroll_test.go

hub v0.14.0: passphrase-authed host enrollment (Day-0 option C)

2026-06-26 15:35:24 +02:00

host_recovery_test.go

feat(hub,install): break-glass recovery vault + mgmt_plane surfacing (TASK G1)

2026-07-05 19:03:18 +02:00

host_swap_rule_test.go

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

host_swap_test.go

hub 0.164.0 (unreleased): host_swap_short / host_swap_ok operator alarm from the agent's host and guest swap numbers (R-1192 follow-up); wire gate allowlists guests.spec.swap_bytes

2026-10-21 21:55:15 +02:00

host_swap.go

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

host_test.go

hub v0.7.4: ingest agent pbs_snapshots (slice 6 Phase B)

2026-06-09 17:15:58 +02:00

host_tunnel_test.go

hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

2026-10-22 21:04:42 +02:00

host_tunnel.go

hub 0.167.0 source: the stale-tunnel text no longer promises 15 minutes flat (15 min after the agent sees the sign, plus its next desired-state fetch) — review N8

2026-10-22 23:00:46 +02:00

household_prefs_test.go

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

household_prefs.go

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

logbundle_ack_test.go

hub v0.46.0: observability pass — per-box log pulls, bundle custody, 72h TTL + secret gate

2026-07-11 16:57:47 +02:00

logtail_ack_test.go

hub v0.43.0: remote app-log diagnostics — copyable issues + context + on-demand log tails + range/dismissal fixes

2026-07-10 16:03:32 +02:00

mail_test.go

hub v0.18.0: app-email passthrough POST /api/v1/mail → Resend SMTP

2026-06-29 08:45:22 +02:00

mail.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

mailhold_test.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

managed_floor_ack_test.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

offsite_test.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

offsite.go

hub v0.128.0: set-aside deletion through the hub after a 7-day wait (decision 74, R-823), key-file clean-up route (R-826), read-only key check (R-827), window cap = half

2026-10-04 07:05:21 +02:00

opactions_test.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

opactions.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

os_updates_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

os_updates.go

hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

2026-10-04 10:56:39 +02:00

passphrase_scope.go

hub v0.161.0: passphrase keys only until the box uses its own (box-config route; R-1159, D19); ep0 namespaces without a prune job alarmed, tenantsync v1.3.0 creates the job (R-1165)

2026-10-19 15:55:45 +02:00

pbsdr_test.go

hub: R-39 core — stamp a secret GENERATION into the pbs_dr descriptor

2026-07-21 09:52:04 +02:00

pbsdr.go

hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

2026-07-10 20:49:48 +02:00

poke_seam_test.go

hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

2026-07-17 17:30:41 +02:00

preferences_guard_test.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

r262_restoretest_subset_test.go

burn-down Part B: 14 small rows fixed and closed across four repos (306 -> 292); no :latest in the hub build; gate list pinned; closed-id duplicates refused; R-262 subset pinned

2026-10-05 17:10:38 +02:00

r304_older_package_event_test.go

R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

2026-10-08 10:09:20 +02:00

r330_smart_counters_test.go

R-330: the hub models SMART 187/188/199 in the host-report (G-1; nothing alarms on them yet)

2026-10-06 22:03:49 +02:00

r366_foreign_key_archives_test.go

R-366 slice 2 (decision 168): one operator line when the box's whole-guest archives include another key's (edge-triggered)

2026-10-07 10:21:25 +02:00

r387_severity_visibility_test.go

hub v0.107.0: the hub rewrote a severity and said nothing (R-387); golden 0.223.0

2026-08-23 11:57:26 +02:00

r871_catchup_event_test.go

hub v0.134.0: a down box is judged on longer missed-backup lines (R-872); household outage mail at most weekly (R-873); backup_catchup_done allowed (R-871)

2026-10-05 09:24:14 +02:00

r879_box_seal_test.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

r895_events_test.go

Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass

2026-10-17 23:31:34 +02:00

r1140_accesslog_test.go

Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass

2026-10-17 23:31:34 +02:00

r1150_events_test.go

hub v0.159.0: a refused whole-guest backup has its own alarm (R-1150); a reinstall re-issues the claim code and the off-site login when the old host is stale or off (R-1154)

2026-10-19 03:18:34 +02:00

r1154_reenroll_test.go

hub v0.160.0: a live re-enroll mails the operator (R-1156); further refused backups counted, alarm once a day (R-1157); the reinstall's off-site re-issue says what it still does (R-1158)

2026-10-19 10:34:41 +02:00

r1159_min_controller_test.go

hub v0.161.0: passphrase keys only until the box uses its own (box-config route; R-1159, D19); ep0 namespaces without a prune job alarmed, tenantsync v1.3.0 creates the job (R-1165)

2026-10-19 15:55:45 +02:00

r1159_passphrase_scope_test.go

hub v0.161.0: passphrase keys only until the box uses its own (box-config route; R-1159, D19); ep0 namespaces without a prune job alarmed, tenantsync v1.3.0 creates the job (R-1165)

2026-10-19 15:55:45 +02:00

r1254_escrow_put_test.go

hub R-1254 (P2): the escrow key, its hash and the identity blob in ONE transaction; a bad identity blob is refused before anything is stored. Committed, not deployed.

2026-10-24 20:37:59 +02:00

recovery_unit_event_test.go

hub v0.89.0 — the two halves of decision D-c (R-167, R-158)

2026-08-02 23:19:13 +02:00

reenroll.go

hub v0.160.0: a live re-enroll mails the operator (R-1156); further refused backups counted, alarm once a day (R-1157); the reinstall's off-site re-issue says what it still does (R-1158)

2026-10-19 10:34:41 +02:00

routes_test.go

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

routes.go

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

spoiled_floor_ack_test.go

hub v0.155.0: the floor can never deliver a withdrawn controller build (R-1085); RomM/Ghost evidence

2026-10-16 12:24:39 +02:00

tunnel_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

upwatch_event_test.go

hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail

2026-10-23 21:26:36 +02:00

wait_test.go

hub: box presence from the wait channel + delete a switched-off box at once (R-30, D2)

2026-10-08 15:17:05 +02:00

wait.go

hub: box presence from the wait channel + delete a switched-off box at once (R-30, D2)

2026-10-08 15:17:05 +02:00

wg_test.go

feat(hub): operator OOB peer + oob_peer_ip desired-state merge (H1 Part 1)

2026-07-05 22:08:06 +02:00

wg.go

hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

2026-07-17 17:30:41 +02:00

whole_guest_event_test.go

hub v0.78.0 — R-97a: whole-guest backup events, operator-only

2026-07-27 16:59:05 +02:00