admin
81d4438630
gates / gates (push) Successful in 8s
- OPEN-ITEMS: all three rows closed with their measurements. R-189 records the migration consequence seen live (a pre-R-189 record has no tier and is not reportable, so upgrading does not retroactively make an old proof visible). R-188 records both directions demonstrated and the fixture cleaned up. R-186 carries the before/after sha values including the CGO_ENABLED discrepancy. The priority list states explicitly that R-185 is the one left open from that group and that this session did not touch it. - capability map: the restore-proof row now says the evidence path itself had a gap — the proof reached the hub only because no restart intervened — and what closed it. - CONTEXT: S-19 (a proof is durable and reportable, a failure is neither, and why) and S-20 (the release ordering, what each step protects, and how a binary is verified). - STATUS: rewritten for the operator, back to one screen.
5.4 KiB
5.4 KiB
STATUS — what works, what's broken, what's next
Updated 2026-08-03.
A view, not a source.
documentation/backlog/OPEN-ITEMS.mdis the authority on open work; this page restates part of it in plain words, and nothing may exist only here. NotCONTEXT.md, which is technical state written for Claude Code — keep the two separate. Maintenance: update at the end of every session in which something shipped, broke, or was decided. One screen; cut items rather than extend it.
What works right now
A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer, who sets their own password. They install apps from a catalogue of fifty-three, share files over the home network, and open apps from a launcher or a shared link. Backups run on their own to three places — the machine's drive, a second drive, and an encrypted off-site copy — and a customer can restore files and app data from the drive alone. Apps come back after a power cut: hard-reset the demo box six times, everything returned every time, and an app switched off deliberately stayed off. Proven end to end on real hardware.
What's broken
- The off-site copy can be erased by the machine that made it. The credential that writes it can also delete it. A daily snapshot is armed as a stopgap, and we have never restored from that copy. (R-95, R-87)
- Nothing else open that affects a customer. The three faults that were on this list yesterday — the reserve watching the wrong step, the last app whose data was never saved, and the alert that told you about one app and swallowed the rest — are all fixed and proven on a real machine.
What shipped recently
- Three ways the alarm system was misreporting its own work — all fixed. None of them ever risked data. (1) When the machine proved a backup restores, that result could vanish if the agent was restarted in the following quarter-hour — and yesterday's change made the gap a week rather than a day, because the machine correctly refuses to re-prove an archive it has already proven. It is now written to disk with the result and survives. This was caught happening, not predicted: a real 14.5 GB off-site restore passed and left no record at all. (2) Every release had about a fifty-fifty chance of emailing you a failure for a release that worked; the version tag is now published after the binary, and a new check catches the opposite mistake so nothing is traded away. (3) A released binary can now be rebuilt by anyone and checked against the fingerprint you approve — until today, rebuilding produced different bytes. (R-189, R-188, R-186)
- Each backup is now proved, instead of the clock being obeyed. The machine used to re-test a backup every twenty-four hours on a timer that restarted whenever the software was updated, so the test happened at an arbitrary time and a fresh backup could sit unproven while an old one was re-checked. Now a copy is tested once, about a day after it is made, and not again until there is a newer one — so the daily copy is proved daily and the weekly off-site copy weekly, each on its own. The alert that says "this copy has not been proved lately" learned each copy's own rhythm in the same change; without that it would have started complaining every night about a system that is working. (R-86)
- A failed backup now tells you about every app, once, with every failure written down whether or not it is emailed, and a message the machine decides not to send now leaves a record saying so. (R-182)
What we're working on
- Now: nothing outstanding.
- Next: proving the off-site app-data copy can actually be restored — the one tier nothing tests unattended. Most of the machinery it needed arrived with the restore-test change below. (R-87)
- After: the off-site copy that the machine making it can still erase. (R-95)
Waiting on you
- A job, not a decision: the hub password needs changing. A diagnostic command printed it into a session log; nothing suggests anyone else saw it. (R-132)
- One small question, not urgent. The automatic check cannot see which version you have told machines to install, only which ones exist. Closing that needs either a password given to the build server or a check inside the hub itself. (R-184)
- Nothing else. The question about whether the off-site endpoint counts as protected is settled — it does, and the machine list now says so instead of asking.
Changed since last update
- 2026-08-03 — Fixed three ways the alarm system misreported itself: a proof of a working backup that could vanish on a restart (seen happening), a release that emailed a failure for a release that worked, and a released binary nobody could rebuild and check. (R-189, R-188, R-186)
- 2026-08-03 — Backups are now proved one at a time, each about a day after it is made, instead of on a timer; the "not proved lately" alert learned each copy's own rhythm so it does not complain about a healthy weekly copy. You settled that the off-site endpoint is protected, and the machine list records it. One thing found while testing: on the small demo machine the agent cannot see its own local backups at all — a permission that was never granted — so that copy has never been test-restored there. Written down, not yet fixed. (R-86, R-185)