812 lines
38 KiB
YAML
812 lines
38 KiB
YAML
# where-felhom-stands.yaml — the data behind documentation/architecture/where-felhom-stands.html
|
||
#
|
||
# THIS IS A VIEW, NEVER A SOURCE. Every entry cites the capability-map row, register row or
|
||
# evidence document it derives from; an entry with no source is a defect, not a claim.
|
||
# A status may not be RAISED here — if the evidence supports a stronger status than the
|
||
# capability map records, the MAP changes first and this file follows it.
|
||
# Regenerate the page after any status move: python3 scripts/render_stands.py
|
||
#
|
||
# YAML rather than JSON, deliberately: statuses move one line at a time and a YAML diff shows
|
||
# which claim moved. A JSON re-dump reflows and shows the whole file.
|
||
#
|
||
# verdict vocabulary: confirmed | downgraded | upgraded | contested | needs-hardware
|
||
# depth: source-read (opened live source or evidence) | register+map (checked against the
|
||
# register and capability map only) | needs-hardware (cannot be settled off-box)
|
||
verified_on: 2026-08-22
|
||
verified_against:
|
||
felhom-agent: 40d857b527
|
||
felhom-controller: 2da259af38
|
||
hub: 877fcd2a38
|
||
claims:
|
||
- id: install.iso-selfregister
|
||
band: journey
|
||
stage: 1
|
||
title: "A blank machine installs itself from our own boot image and registers itself as unclaimed — proven on two different boards"
|
||
status: walked
|
||
note: "Two boards: N100 2026-07-18, HP t740 2026-07-21."
|
||
sources:
|
||
- capability-map: "Bare-metal Felhom ISO (blank hardware → zero-touch auto-install → first-boot host-install)"
|
||
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: install.installer-by-tag
|
||
band: journey
|
||
stage: 1
|
||
title: "The installer is published rather than pushed: rolling it back is one act"
|
||
status: built
|
||
note: "Gate 6 of hostinstall_gates asserts the manifest names an installer-v tag; ran green tonight."
|
||
sources:
|
||
- capability-map: "The installer is PUBLISHED, not pushed"
|
||
- register: "R-110"
|
||
changed:
|
||
from: walked
|
||
reason: "gate 6 asserts the manifest names an installer tag, but no walk of a rollback is on file"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: downgraded
|
||
depth: source-read
|
||
- id: install.byo
|
||
band: journey
|
||
stage: 1
|
||
title: "Installing onto hardware the customer already owns — the path exists, the first real one has not happened"
|
||
status: partial
|
||
note: "UPGRADED: a real --mode byo install completed on demo-hp 2026-08-09 (Day-0 provision SUCCESS, 3m49s). Still not a customer's own hardware, so not 'walked' — but 'has not happened' is now false."
|
||
sources:
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: install.nic-selfheal
|
||
band: journey
|
||
stage: 1
|
||
title: "A machine that ends up on the wrong network port explains itself on screen and finds its way back — proven in a virtual drill, never on metal"
|
||
status: partial
|
||
note: "Map says the same: PROVEN-LIVE (nested drill — nested != metal)."
|
||
sources:
|
||
- capability-map: "Box survives a wrong-NIC install"
|
||
- evidence: "audits/SPIKE-firstboot-nic-sweep-2026-07-22.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: install.reinstall-refuses
|
||
band: journey
|
||
stage: 1
|
||
title: "Reinstalling a machine we previously installed refuses, because our own removal leaves a name service holding the port our own installer checks"
|
||
status: partial
|
||
note: "Warning card. Confirmed live 2026-08-09; dnsmasq restarted by --uninstall seizes :53."
|
||
sources:
|
||
- register: "R-272"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: claim.one-time-code
|
||
band: journey
|
||
stage: 2
|
||
title: "An emailed one-time code; the customer sets their own password and the operator never sees it"
|
||
status: walked
|
||
note: "Exercised live 2026-08-09: reset code accepted at /claim, 302 + session."
|
||
sources:
|
||
- capability-map: "Customer claim: one-time emailed code → customer sets own password"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: claim.selfbind
|
||
band: journey
|
||
stage: 2
|
||
title: "The customer can bind their own machine from a link, with no operator present — done once, for real"
|
||
status: walked
|
||
note: "attempts=0, locked=0, source customer_selfbind, 2026-07-18."
|
||
sources:
|
||
- capability-map: "Customer binds their own appliance (self-service)"
|
||
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: claim.never-by-non-operator
|
||
band: journey
|
||
stage: 2
|
||
title: "It has never been done by a person who is not the operator"
|
||
status: partial
|
||
note: "Map records MISSING (as evidence). Still true after 2026-08-09."
|
||
sources:
|
||
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: claim.code-naming
|
||
band: journey
|
||
stage: 2
|
||
title: "Each of the two secrets has one name on every surface, and the re-enrol mail points at a page a rebuilt machine shows"
|
||
status: built
|
||
note: "Shipped (controller v0.211.0, hub v0.104.0/v0.105.0); no customer has typed the passphrase yet. Operator ruling 2026-10-12 (S13). The old defect cost a real code on 2026-08-09."
|
||
sources:
|
||
- register: "R-282"
|
||
- register: "R-295"
|
||
- register: "R-323"
|
||
- register: "R-327"
|
||
verified:
|
||
date: 2026-10-12
|
||
verdict: upgraded
|
||
depth: register+map
|
||
- id: use.catalog
|
||
band: journey
|
||
stage: 3
|
||
title: "Apps installed from a catalog of about 52, with a memory guard and health-aware progress"
|
||
status: walked
|
||
note: "53 templates listed on the rebuilt box 2026-08-09; deploy driven live."
|
||
sources:
|
||
- capability-map: "Deploy an app from the catalog (env config, memory guard, health-aware progress)"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: use.lifecycle
|
||
band: journey
|
||
stage: 3
|
||
title: "Start, stop, restart, update, logs, remove — and the parts that must not be stopped cannot be"
|
||
status: walked
|
||
note: "Walked 2026-10-28 night on scratch 9202: install, stop, start, restart, logs; traefik and cloudflared refuse a stop (403); remove with data leaves no volume and no container. The update half: the same day's guarded updates on 9202 (bench + box + undo walks)."
|
||
sources:
|
||
- capability-map: "App lifecycle: start/stop/restart/update/logs/remove/redeploy"
|
||
- register: "R-108"
|
||
- evidence: "audits/night-2026-10-28/part5-claims/lifecycle-walk.log"
|
||
- evidence: "audits/dockerhub-bigsteps-2026-10-28"
|
||
changed:
|
||
from: built
|
||
reason: "a walk document is now cited (2026-10-28 night)"
|
||
verified:
|
||
date: 2026-10-28
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: use.tunnel
|
||
band: journey
|
||
stage: 3
|
||
title: "Reachable from anywhere through a tunnel, per-app addresses"
|
||
status: walked
|
||
note: "Verified tonight: the rebuilt box answered on its public URL from outside."
|
||
sources:
|
||
- capability-map: "Remote access via Cloudflare Tunnel + Traefik (per-app subdomains)"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: use.lan-fallback
|
||
band: journey
|
||
stage: 3
|
||
title: "Reachable on the home network when the internet is down"
|
||
status: partial
|
||
note: "Walked 2026-11-03: with the internet gone the dashboard answers at the box's own address, and the box's DNS answers every app's name. By NAME it needs the home network's DNS to point at the box, and nothing tells the household; on a host whose FQDN is the dashboard's name (Tester 1) that one name answers the host and fails (R-1364)."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/lan-resolver.txt"
|
||
- evidence: "audits/security-2026-11-02/part5/outage-wan.log"
|
||
- register: "R-1364"
|
||
- capability-map: "LAN access when internet is down (lan_resolver)"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: use.files
|
||
band: journey
|
||
stage: 3
|
||
title: "Phone photos, documents with text recognition, files from Windows Explorer or a Mac"
|
||
status: walked
|
||
sources:
|
||
- capability-map: "Files from Windows Explorer / Mac Finder (SMB server)"
|
||
- evidence: "audits/SPIKE-lan-discovery-2026-07-18.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: use.launcher
|
||
band: journey
|
||
stage: 3
|
||
title: "A one-tap launcher, and a read-only guest link for visitors"
|
||
status: walked
|
||
note: "Walked 2026-10-28 night on scratch 9202 through the pages the browser receives: the launcher lists each openable app; the guest link opens with no login and no admin link, a wrong token is 404, rotate and switch-off kill the old link."
|
||
sources:
|
||
- capability-map: "Indítópult (app launcher) — one-tap grid of the household's openable apps"
|
||
- evidence: "audits/night-2026-10-28/part5-claims/launcher-walk.log"
|
||
changed:
|
||
from: built
|
||
reason: "walked live 2026-10-28 night (map E8, E9 → PROVEN-LIVE)"
|
||
verified:
|
||
date: 2026-10-28
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: use.dlna
|
||
band: journey
|
||
stage: 3
|
||
title: "Media to a TV"
|
||
status: missing
|
||
note: "Map: MISSING."
|
||
sources:
|
||
- capability-map: "Media to TV via DLNA"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: use.multiuser
|
||
band: journey
|
||
stage: 3
|
||
title: "Separate accounts per household member"
|
||
status: missing
|
||
note: "Map: MISSING."
|
||
sources:
|
||
- capability-map: "Multiple household users / per-person accounts"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: drives.enrol
|
||
band: journey
|
||
stage: 4
|
||
title: "A new drive is found, offered, formatted, mounted and enrolled — including on awkward older boot layouts"
|
||
status: walked
|
||
note: "Applies to a NEW drive. Re-attaching an existing one after a reinstall is R-280 and fails."
|
||
sources:
|
||
- capability-map: "Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts"
|
||
- register: "R-220"
|
||
- evidence: "audits/SPIKE-raw-drive-enroll-2026-06-15.md"
|
||
changed:
|
||
from: built
|
||
also_moved: 2026-08-09 walked -> built
|
||
reason_superseded: "the 2026-08-09 walk exercised RE-attach (which failed, R-280); first-enrolment of a NEW drive has no walk on file"
|
||
reason: "receipt found 2026-08-10: a live throwaway drive on felhom-pve walked scan -> format -> mount -> PVE dir storage -> one-click Regisztralas, with the resulting storage.cfg entry and systemd mount unit recorded. The map already read PROVEN-LIVE; the dataset was behind it. Scope unchanged: this is a NEW drive. Re-attaching an existing one after a reinstall is R-280 and still fails."
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: drives.migrate
|
||
band: journey
|
||
stage: 4
|
||
title: "Moving data between drives, crash-safe; removing a drive safely; unplug detected"
|
||
status: built
|
||
sources:
|
||
- capability-map: "Data migration between drives (all / per-app), crash-safe"
|
||
changed:
|
||
from: walked
|
||
reason: "no walk document cited"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: downgraded
|
||
depth: register+map
|
||
- id: drives.nas
|
||
band: journey
|
||
stage: 4
|
||
title: "A network drive can be browsed and hold bulk media, but may not hold an app's data — enforced"
|
||
status: walked
|
||
note: "RefuseAsAppNamespace is the fail-closed predicate."
|
||
sources:
|
||
- capability-map: "Network storage (NAS) is browse + bulk-media only"
|
||
- register: "R-108"
|
||
- evidence: "audits/R108-network-app-namespace-2026-07-30.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: drives.reattach-wall
|
||
band: journey
|
||
stage: 4
|
||
title: "After a reinstall the data drive cannot be re-attached through any dashboard route"
|
||
status: partial
|
||
note: "Warning card. /api/disks/candidates returns empty; the restore page promises two clicks."
|
||
sources:
|
||
- register: "R-280"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: backup.tier1
|
||
band: journey
|
||
stage: 5
|
||
title: "App data on the machine, nightly database dumps, a copy on a second drive"
|
||
status: walked
|
||
note: "True for every app but one, and that one was found on 2026-08-21: paperless-ngx's 72-table PostgreSQL was dumped nightly and written into a folder named after an app that does not exist, so it never entered the recovery unit, the second-drive copy or the off-site copy. Fixed and proven live 2026-08-22 (R-355) — the dump is now in the app's own unit and in the off-site snapshot for the first time. A catalogue-wide sweep, itself proven able to convict a planted case, says 1 of 53 was affected."
|
||
sources:
|
||
- capability-map: "Tier-2 secondary-drive copy: class-driven legs"
|
||
- register: "R-355"
|
||
- evidence: "audits/CAMPAIGN-8-backup-restore-2026-07-27.md"
|
||
- evidence: "audits/DRILL-backup-truth-2026-08-21/evidence/phase4-paperless/FINDING.txt"
|
||
changed:
|
||
from: built
|
||
also_moved: 2026-08-09 walked -> built
|
||
reason_superseded: "no walk document cited"
|
||
reason: "receipt found 2026-08-10: an adversarial, destructive, unattended overnight campaign across both boxes and ep0, with A2 (one quiesce, two tiers) proven end to end. Map already read PROVEN-LIVE."
|
||
verified:
|
||
date: 2026-08-22
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: backup.whole-machine
|
||
band: journey
|
||
stage: 5
|
||
title: "A whole-machine archive that lands off the guest's own disk — a single-drive machine is recorded as degraded rather than pretending"
|
||
status: built
|
||
sources:
|
||
- capability-map: "Whole-guest backup lands OFF the guest's own physical device"
|
||
- register: "R-165"
|
||
changed:
|
||
from: walked
|
||
reason: "no walk document cited"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: downgraded
|
||
depth: register+map
|
||
- id: backup.offsite
|
||
band: journey
|
||
stage: 5
|
||
title: "An encrypted off-site copy, sealed with a key the operator cannot read"
|
||
status: walked
|
||
note: "DAILY and UNBROKEN, read from the repositories 2026-11-02: demo-hp 14–15 snapshots every day 10-21 → 11-02, Tester 1 4 every day 10-27 → 11-02. The 2026-08 gap's two causes were fixed (R-199, R-193). The key stays the household's."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/offsite-demo-hp.txt"
|
||
- evidence: "audits/security-2026-11-02/part5/offsite-tester1.txt"
|
||
- capability-map: "Offsite (restic → Hetzner Storage Box)"
|
||
- register: "R-199"
|
||
- register: "R-193"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
changed:
|
||
from: walked
|
||
reason: "the claim is about a CONTINUING daily copy; a 12-day silent gap was found on 2026-08-21 and nothing reported it"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: backup.restore-proof
|
||
band: journey
|
||
stage: 5
|
||
title: "The backups prove themselves: a restore is actually performed, unattended, on every tier, on both machines"
|
||
status: walked
|
||
note: "Read 2026-11-02 from the journals of all three boxes: a scheduled restore-test passed on every tier in 10 days — demo-hp local and PBS, Tester 1 local and PBS, the N100 its USB drive and PBS, the newest on 2026-11-02 22:45. R-366's orphaned key was a one-off of the 2026-08 reinstall."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part4/restore-test-demo-hp.txt"
|
||
- evidence: "audits/security-2026-11-02/part4/restore-test-tester1.txt"
|
||
- evidence: "audits/security-2026-11-02/part4/restore-test-n100.txt"
|
||
- capability-map: "Restore-proof is UNATTENDED — the scheduler covers EVERY tier"
|
||
- register: "R-86"
|
||
- register: "R-366"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
changed:
|
||
from: walked
|
||
reason: "no walk document cited, and the last recorded restore-test on demo-hp FAILED (2026-08-05)"
|
||
decay: "PROOF-DECAY RULE FIRED (first time it has). A receipt EXISTS - architecture/_recovery-inventory-2026-07-28.md carries live journal lines for scheduled restore-tests on both boxes and both tiers - but it is superseded by later observation: demo-hp logged restore_test_failed on 2026-08-05, and the box has since been wiped and reinstalled (2026-08-09). The claim is about a CONTINUING scheduled behaviour, so a 2026-07-28 observation cannot carry it. Stays grey until a scheduled restore-test is seen passing on the rebuilt box. THE CAPABILITY MAP STILL READS PROVEN-LIVE (2026-08-03) AND IS NOW THE THING OUT OF STEP."
|
||
worse_2026_08_22: "It failed AGAIN, unprompted, on 2026-08-21 21:59 - and the cause is worse than 'untested'. Hub event 3016: the PBS archive of 2026-08-18 could not be restored because the manifest's key does not match the key the rebuilt box now presents. The archives that predate the 2026-08-21 reinstall are UNREADABLE to the machine that made them (R-366). Credit where due: the mechanism caught it and named the key mismatch precisely. The gap is that it is reported as 'a restore test failed' rather than 'your older whole-machine backups cannot be opened on this box'."
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: backup.fill-warning
|
||
band: journey
|
||
stage: 5
|
||
title: "The customer is warned before a drive fills, per drive, in their own language"
|
||
status: walked
|
||
note: "Walked 2026-11-03 on Tester 1: a data drive taken to 89 %; the watcher (every 10 minutes since R-363) warned at its next tick, 2 minutes later: the household's Hungarian mail names the drive and 5,2 GB free, once. The August gap (a daily check) is gone. The cadence leaves a drive up to 10 minutes."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/fill-walk.log"
|
||
- evidence: "audits/security-2026-11-02/part5/mail-fill-household.txt"
|
||
- capability-map: "The customer is warned BEFORE a filesystem fills"
|
||
- register: "R-167"
|
||
- register: "R-363"
|
||
- evidence: "audits/SPIKE-r165-mp1-merge-2026-08-02.md"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
changed:
|
||
from: walked
|
||
reason: "a daily check cannot carry the word BEFORE; observed silent for the whole window a filesystem sat at 99%"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: backup.sikeres
|
||
band: journey
|
||
stage: 5
|
||
title: "A backup that covered nothing still calls itself successful"
|
||
status: partial
|
||
note: "Warning card — and the drill found two more of it, both live. (1) An off-site run with no app selected logs 'backup OK: 0 app(s) backed up'; the card does say 'nincs kijelölt alkalmazás' beside the green tick, so this one is honest if you read past the tick. (2) A restore that placed nothing reported success: '0 fájl visszaállítva', ok=true. The second is the one that matters and it is R-353, still open. The volume half of it is fixed (R-354): the message now names what came back."
|
||
sources:
|
||
- register: "R-240"
|
||
- register: "R-353"
|
||
- register: "R-354"
|
||
- evidence: "audits/DRILL-backup-truth-2026-08-21/evidence/phase3-experiment/messages-verbatim.txt"
|
||
verified:
|
||
date: 2026-08-22
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fault.selfheal
|
||
band: journey
|
||
stage: 6
|
||
title: "The machine watches itself and repairs some faults without telling anyone it had to"
|
||
status: walked
|
||
note: "Walked 2026-10-29 night on scratch 9202: a crashed app part (kill -9 of paperless-redis) ran again in 1 s and the health probe read the app healthy; a guest reboot brought every app back in under 2 minutes, the boot sweep found nothing to start; no event, no banner, no mail. Docker's restart policy did the repair in both legs; the controller's own boot repair had nothing to do (its last proof: 6 of 6 hard resets, 2026-08-02). R-264 records that the self-heal counters reach the hub and are decoded nowhere."
|
||
sources:
|
||
- capability-map: "Box survives an unattended app or guest-network failure"
|
||
- register: "R-264"
|
||
- evidence: "audits/night-2026-10-28/part5-claims/selfheal/WALK.md"
|
||
- evidence: "audits/DIAG-bootrecon-drive-absent-2026-08-02.md"
|
||
changed:
|
||
from: built
|
||
reason: "walked 2026-10-29 on scratch 9202 (a walk document is now cited)"
|
||
verified:
|
||
date: 2026-10-29
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fault.operator-email
|
||
band: journey
|
||
stage: 6
|
||
title: "Failures reach the operator by email, one mail per run, every failing app named"
|
||
status: walked
|
||
note: "Seen in the mailbox: „Tester4: 3 of 8 apps failed to back up (manual run)\" names immich, nextcloud and paperless-ngx in one mail (2026-10-20); seven of this shape in 60 days."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/mail-operator-digest.txt"
|
||
- capability-map: "A failed per-app Tier-1 backup reaches the OPERATOR — EVERY failing app, in ONE mail per run"
|
||
- register: "R-182"
|
||
changed:
|
||
from: walked
|
||
reason: "the digest is wired and source-verified, but no run of it has been observed delivering"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fault.customer-email
|
||
band: journey
|
||
stage: 6
|
||
title: "Failures reach the customer"
|
||
status: walked
|
||
note: "Seen in the mailbox: the crash mail and the fill warning to tester1@ (2026-11-02/03), „A szerver nem elérhető!\" to tester4@ (2026-10-24), each in Hungarian. It needs an address on the household's page (Tester 1 had none)."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/mail-crash-household.txt"
|
||
- evidence: "audits/security-2026-11-02/part5/mail-fill-household.txt"
|
||
- evidence: "audits/security-2026-11-02/part5/mail-operator-digest.txt"
|
||
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fault.already-paired
|
||
band: journey
|
||
stage: 6
|
||
title: "An already-paired box no longer tells anyone to pair it — its console says there is nothing to do"
|
||
status: walked
|
||
note: "Was a warning card (the console kept showing the pairing code). Fixed by ISO 1.28.0 (R-535; R-214, R-235 closed). Walked 2026-10-29 00:04 on Tester 1 (paired, claimed): the console reads, in Hungarian and English, that there is nothing to do on this machine and no need to log in — no pairing code."
|
||
sources:
|
||
- register: "R-214"
|
||
- register: "R-235"
|
||
- evidence: "audits/night-2026-10-28/part5-claims/tester1-console-2026-10-29.png"
|
||
changed:
|
||
from: partial
|
||
reason: "the defect is closed and the console was read live on a paired box (2026-10-29)"
|
||
verified:
|
||
date: 2026-10-29
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: recover.screen
|
||
band: journey
|
||
stage: 7
|
||
title: "A rebuilt machine shows a full-page recovery screen without anyone looking for it, and says plainly that nobody can replace a lost recovery code"
|
||
status: walked
|
||
note: "Seen unsought on the rebuilt demo-hp 2026-08-09, seal date matching host_escrow.created_at."
|
||
sources:
|
||
- register: "R-193"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: recover.byte-identical
|
||
band: journey
|
||
stage: 7
|
||
title: "The customer's code opens the sealed package and the data returns byte for byte — including accented Hungarian filenames, verified as raw bytes"
|
||
status: walked
|
||
note: "Still true, and re-proven 2026-08-22 (5/5 byte-identical, both accented names as raw bytes) — but the SCOPE is narrower than the sentence sounds and was silently narrower still until v0.218.0. The drill found the off-site restore had NO named-volume leg at all: the archive sat in the unit, the snapshot and the checking folder and was never replayed, under a success message (R-354, fixed and proven 2026-08-22). AND 40 of the 53 catalogue apps STILL cannot run this route at all — it refuses first, saying a running app is not installed (R-356, open). So: proven for an app that declares a data drive; unproven and currently unreachable for the class whose entire dataset is a named volume."
|
||
sources:
|
||
- register: "R-201"
|
||
- register: "R-354"
|
||
- register: "R-356"
|
||
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
verified:
|
||
date: 2026-08-22
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: recover.no-shell
|
||
band: journey
|
||
stage: 7
|
||
title: "Walked end to end with no command line inside the machine (2026-08-07)"
|
||
status: walked
|
||
note: "CONTESTED-RESOLVED: not a contradiction. The walk proves the ROUTE needs no guest shell; the map's MISSING row is about a NON-OPERATOR doing it, which has still never happened. Two questions, one word 'customer'."
|
||
sources:
|
||
- register: "R-201"
|
||
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
|
||
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: contested
|
||
depth: source-read
|
||
- id: recover.putback
|
||
band: journey
|
||
stage: 7
|
||
title: "Putting restored files back where they belong is still manual"
|
||
status: partial
|
||
note: "Warning card. Confirmed 2026-08-09: the restore lands in a verification folder and says so."
|
||
sources:
|
||
- register: "R-213"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: recover.tripwire
|
||
band: journey
|
||
stage: 7
|
||
title: "The tripwire that says someone is opening this customer's backups does fire"
|
||
status: walked
|
||
note: "CONFIRMED tonight from the hub store: escrow_blob_served 2026-08-09 10:19:41Z = 12:19 CEST in the operator's mailbox. R-281's original claim of silence is WITHDRAWN."
|
||
sources:
|
||
- register: "R-281"
|
||
- register: "R-285"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.disk-failing
|
||
band: failures
|
||
title: "A disk starts failing — healthy path only; a genuinely failing disk has never been seen"
|
||
status: partial
|
||
note: "Only a failing disk on a running box could settle it."
|
||
sources:
|
||
- capability-map: "Lemez-egészség felügyelet: per-disk SMART kártya"
|
||
- evidence: "audits/SPIKE-smart-coverage-2026-07-25.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: needs-hardware
|
||
depth: needs-hardware
|
||
- id: fail.backup-drive-unplugged
|
||
band: failures
|
||
title: "The backup drive is unplugged"
|
||
status: walked
|
||
sources:
|
||
- capability-map: "An ABSENT backup-target drive raises its OWN alarm"
|
||
- evidence: "audits/R116-v0116-2026-07-30.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: fail.drive-filling
|
||
band: failures
|
||
title: "A drive is filling up"
|
||
status: walked
|
||
note: "Same walk as backup.fill-warning: warned before it filled; the file removed, nothing else was needed."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/fill-walk.log"
|
||
- register: "R-167"
|
||
changed:
|
||
from: walked
|
||
reason: "no walk document cited"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fail.app-crash
|
||
band: failures
|
||
title: "An app crashes — the box stops it and both the operator and the household get a mail"
|
||
status: walked
|
||
note: "Walked 2026-11-02 on Tester 1: kill -9 of a throwaway app, 15 s apart; at 6 restarts in 10 minutes the box stopped and held it, the operator's mail arrived in 1 s; with an address on the household's page the Hungarian mail arrived too. The household's Start lifted it. One flaw: the mail ends with raw JSON (R-1363)."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/crash-walk.log"
|
||
- evidence: "audits/security-2026-11-02/part5/crash-walk-customer.log"
|
||
- evidence: "audits/security-2026-11-02/part5/mail-crash-operator.txt"
|
||
- evidence: "audits/security-2026-11-02/part5/mail-crash-household.txt"
|
||
- register: "R-1363"
|
||
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fail.power-cut
|
||
band: failures
|
||
title: "Power cut mid-backup"
|
||
status: walked
|
||
sources:
|
||
- evidence: "audits/AUDIT-power-outage-recovery-2026-07-22.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: fail.guest-destroyed
|
||
band: failures
|
||
title: "The guest is destroyed"
|
||
status: walked
|
||
sources:
|
||
- register: "R-201"
|
||
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
|
||
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: fail.wiped-reinstalled.data
|
||
band: failures
|
||
title: "The whole machine is wiped and reinstalled — the data comes back"
|
||
status: partial
|
||
note: "The 2026-08-09 rehearsal really did return 4/4 byte-identical, and that stands. What the next real reinstall showed (2026-08-21, demo-hp) is that the rebuild ORPHANS BOTH OFF-PREMISES TIERS at once, quietly: the restic target was lost and needed a self-heal plus a per-app re-enable before any copy resumed (R-193), and the PBS archives from before the reinstall cannot be opened by the rebuilt box at all, because it now presents a different key (R-366). The data came back in the rehearsal because the rehearsal restored it immediately; a machine left alone after a reinstall is not protected in the meantime and nothing says so."
|
||
sources:
|
||
- register: "R-193"
|
||
- register: "R-366"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
changed:
|
||
from: walked
|
||
reason: "a real reinstall on 2026-08-21 left both off-premises tiers broken - one silently for 12 days, the other unreadable - so 'the data comes back' holds only if someone restores it at once"
|
||
verified:
|
||
date: 2026-08-22
|
||
verdict: downgraded
|
||
depth: source-read
|
||
- id: fail.wiped-reinstalled.journey
|
||
band: failures
|
||
title: "The whole machine is wiped and reinstalled — the journey needs a terminal twice"
|
||
status: partial
|
||
note: "CONTESTED-RESOLVED against the map: the map's PROVEN-LIVE row is scoped to a controller-data-volume REBUILD (2026-08-04), not a whole-host reinstall. The map has no row for the host case, so there was no contradiction — only a gap."
|
||
sources:
|
||
- register: "R-273"
|
||
- register: "R-280"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.stolen-machine
|
||
band: failures
|
||
title: "The machine is stolen, and someone opens the backups — the operator is told"
|
||
status: walked
|
||
note: "Confirmed 2026-08-09 from the store and the mailbox."
|
||
sources:
|
||
- register: "R-281"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.forgot-password
|
||
band: failures
|
||
title: "The customer forgets their dashboard password"
|
||
status: walked
|
||
note: "Exercised 2026-08-09 via the reset code."
|
||
sources:
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.lost-recovery-code
|
||
band: failures
|
||
title: "The customer loses their recovery code — by design, the data is unrecoverable"
|
||
status: walked
|
||
note: "The recovery screen states it in Hungarian."
|
||
sources:
|
||
- capability-map: "Escrow ceremony: customer-facing wizard, one-shot R claim, operator zero-knowledge"
|
||
- register: "R-198"
|
||
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
||
changed:
|
||
from: built
|
||
also_moved: 2026-08-09 walked -> built
|
||
reason_superseded: "a by-design refusal; no walk document cited"
|
||
reason: "receipt found 2026-08-10, and then proven the hard way: the recovery screen states in Hungarian that nobody can replace a lost code, and on 2026-08-10 demo-felhom's pre-fix key was confirmed unrecoverable by construction (identity_blob NULL; the restic password lives only in that bundle). The by-design refusal is real."
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fail.moves-house
|
||
band: failures
|
||
title: "The machine moves house / new network"
|
||
status: walked
|
||
sources:
|
||
- capability-map: "Box survives a site/network change (relocation, different subnet, DHCP re-lease)"
|
||
- evidence: "audits/AUDIT-vacation-remote-ops-2026-07-20.md"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: fail.internet-down
|
||
band: failures
|
||
title: "The internet goes down"
|
||
status: walked
|
||
note: "Walked 2026-11-03 on Tester 1: packets to the outside dropped on host and guest for 13 minutes, the line's route left in place. The dashboard answered on the home network, 10 apps ran, the public name gave 530; 60 s after the line came back the public name worked by itself, nothing to do. Slow: the Backups page took over 2 minutes (R-1362). An earlier try removed the route: the agent's self-heal put it back in about 100 s."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/outage-wan.log"
|
||
- evidence: "audits/security-2026-11-02/part5/outage-wan-3min.txt"
|
||
- register: "R-1362"
|
||
- capability-map: "LAN access when internet is down (lan_resolver)"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fail.hub-down
|
||
band: failures
|
||
title: "The hub is down"
|
||
status: partial
|
||
note: "Walked 2026-11-03 on Tester 1 (the hub's address dropped for 13 minutes; DooPlex untouched): the box works on — dashboard, apps, an install from the cached catalog, a crash-loop stop. What fails: every event sent in that time is lost after 9 s and nothing re-sends it, so the operator never heard of the held app (R-1361)."
|
||
sources:
|
||
- evidence: "audits/security-2026-11-02/part5/outage-hub.log"
|
||
- register: "R-1361"
|
||
- capability-map: "Config/state change round-trips in seconds (hub↔box immediacy"
|
||
changed:
|
||
from: walked
|
||
reason: "no walk document cited"
|
||
verified:
|
||
date: 2026-11-03
|
||
verdict: upgraded
|
||
depth: source-read
|
||
- id: fail.broken-release
|
||
band: failures
|
||
title: "We ship a broken release — the guard is missing"
|
||
status: missing
|
||
note: "Proven the hard way on 2026-08-09: a vouched agent version had no git tag and every install died at 5/8. Both guards still owed."
|
||
sources:
|
||
- register: "R-273"
|
||
- register: "R-287"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.stale-image
|
||
band: failures
|
||
title: "A fresh install picks up an old image"
|
||
status: partial
|
||
note: "Narrowed 2026-08-09: the resume path fetched the vouched golden; a fresh install still takes the newest LOCAL archive with no manifest comparison."
|
||
sources:
|
||
- register: "R-274"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.offsite-account-deleted
|
||
band: failures
|
||
title: "The off-site provider account is deleted"
|
||
status: partial
|
||
note: "The credential that holds the customer's documents can still delete."
|
||
sources:
|
||
- register: "R-95"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: register+map
|
||
- id: fail.expected-downtime
|
||
band: failures
|
||
title: "The machine is switched off for an afternoon — no notion of expected downtime"
|
||
status: missing
|
||
note: "Confirmed 2026-08-09: eight operator mails for deliberate, attended work."
|
||
sources:
|
||
- register: "R-285"
|
||
verified:
|
||
date: 2026-08-09
|
||
verdict: confirmed
|
||
depth: source-read
|
||
- id: fail.customer-self-restore
|
||
band: failures
|
||
title: "A customer restores their own data with no help"
|
||
status: partial
|
||
note: "Walked 2026-10-29 night on scratch 9202 through the household's restore button (the page's own POST): vikunja from the 02:30 local point in 79 s — the project made before the point came back, the one made after it is gone, the app runs, no hold; a restore that meets a busy volume puts the live data back (R-1256 H5). The route needs no help. Still open: no person who is not the operator has done it (claim.never-by-non-operator). The old off-site blocker (R-356) shipped in controller v0.219.0."
|
||
sources:
|
||
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
||
- register: "R-201"
|
||
- register: "R-356"
|
||
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
||
- evidence: "audits/night-2026-10-28/part5-claims/selfrestore-walk.log"
|
||
verified:
|
||
date: 2026-10-29
|
||
verdict: confirmed
|
||
depth: source-read
|