felhom.eu/documentation/audits/bughunt-reconcile-2026-06-13.md

> **REMEDIATION STATUS — updated 2026-06-13 (controller v0.59.0, deployed to demo guest 9201).**
> Authoritative copy of the BUGHUNT reconciliation. Statuses for the actioned findings:
>
> | Finding | Reconcile verdict | Remediation |
> |---|---|---|
> | H10 (plaintext secret on encrypt failure) | LIVE/PARTIAL | **FIXED** (fail-closed) — controller `5a80739` (v0.59.0) |
> | M2 (unlocked stackProvider read) | LIVE (benign) | **FIXED** (init-only, lock removed) — controller `092cbbe` (v0.59.0) |
> | C2,H5,H6,H7,H8 | FIXED (pre-existing) | confirmed already fixed |
> | C3 (SSD-only DB DR loss) | **MOOT-by-architecture** | whole-LXC PBS DR; no action needed |
> | C1,H9,H11 + file-gone Lows | MOOT | confirmed gone-and-not-migrated |
> | `[backlog]` Mediums M4/M5/M6, M18/M19, M25 | survived, NOT verified | recorded for a future deep pass |
>
> Fresh findings actioned: CTRL-001 **FIXED** (`c20ff56`), CTRL-T2-1 **FIXED** (`5a80739`),
> AGENT-001 **FIX PREPARED/PENDING** (agent `d96e5bd`).

# BUGHUNT RECONCILIATION — v0.30.3 findings vs current code — 2026-06-13

**Task:** Reconcile the stale `BUGHUNT.md` (v0.30.3, 67 findings) against current code. Verdict each: FIXED / MOOT / LIVE with file:line evidence. NOT a new audit, NOT a fix pass.
**Branch:** `audit/2026-06-13-bughunt-reconcile` (off current `main`)

| Repo | HEAD commit | Version |
|---|---|---|
| felhom-controller | `eea235bd6952184c4681b4b133396d6b8b0aaf33` | v0.58.0 |
| felhom-agent | `d17b5ab45dc7df51836e26d7a38450cd391b94b2` | v0.29.1 |

**Inputs:** `BUGHUNT.md` (v0.30.3, full), `AUDIT-2026-06-13.md` (fresh audit, full). **Cardinal rule applied:** a fix-tag comment (`// H10 fix`) is a CLAIM — verified the mechanism in every case; it caught H10 (the tag added a log but did NOT close the bug).

## Progress log

- 19:20 — Branch created off main (eea235b). Skeleton committed + pushed. Agent migration targets located.
- 19:25 — Parts 1/2/3 dispatched in parallel (3 auditors). All returned.
- 19:45 — **Verified by hand:** C3 MOOT-by-architecture (the priority verdict); H10 PARTIAL (read deploy.go:641-666 — `// H10 fix` only adds a WARN, still persists plaintext). Wrote + ran failing evidence test `internal/stacks/saveappconfig_h10_reconcile_test.go` — FAILS, app.yaml contains the plaintext secret.
- 19:55 — Report assembled (Parts 1-5). Committed.

## Executive summary

Of the **62 findings not previously closed** (67 − the 5 concurrency Highs H1–H4/H12 already confirmed fixed in the fresh audit):
- **C3 verdict (priority): MOOT-by-architecture.** DR was re-platformed to whole-LXC PBS restore (the original `restore_*_linux.go` files are gone, not migrated). DB volumes ride inside the block image; the per-app/dump paths route through `GetAppDrivePath` which explicitly falls back to `systemDataPath` when `HDDPath==""`, and DB discovery is docker-ps-driven, never HDD-gated. An SSD-only app's database cannot be silently dropped on any current restore path. No silent DR data-loss.
- **7 HIGH survivors:** C2, H5, H6, H7, H8 → **FIXED** (mechanisms verified, not just the tags). C3 → **MOOT**. **H10 → PARTIAL/LIVE** — the tagged fix only logs a WARN and still writes the secret in plaintext on a `crypto.Encrypt` failure (failing evidence test written).
- **MOOT bucket:** C1 (agent watchdog uses the panic-safe inverse pattern — checked the migrated code), H9 (restic retired; agent backup has no retry-reusing-context), H11 (handler gone; replacement `tier2_config_handler.go` DOES validate the dest against the registered-drive allowlist), and file-gone Lows L7/L8/L9/L11/L12/L14/L18 — all confirmed gone-and-not-migrated-with-bug.
- **Tallies (verdicted findings):** FIXED = 5 (C2,H5,H6,H7,H8) · MOOT = 11 (C3,C1,H9,H11,L7,L8,L9,L11,L12,L14,L18) · LIVE/PARTIAL = 1 (H10). Plus M2 (=fresh-audit CTRL-T3-1) is the one LIVE survivor among the mechanically-triaged Mediums.
- **Mechanical M/L triage:** ~half the Mediums and Lows are CODE-GONE (restic/crossdrive/monitor/restore_*_linux deleted); the survivors form a known backlog (deep-verify deferred per the task). Several incidentally show their fix already in place (M1 ConstantTimeCompare, M3/M13/M14/M15/M23 addressed).

**Net actionable:** the 3 validated fresh findings + **H10** (plaintext-secret-on-encrypt-failure) + **M2** (unlocked stackProvider read). Everything else is FIXED, MOOT, or a not-yet-verified backlog Medium/Low.

## Part 1 — The 7 surviving HIGH findings

### C2 — SetGeoAppOverride nil-override deref
BUGHUNT ref: line 58 (v0.30.3)
Verdict:     **FIXED**
Current:     controller/internal/settings/settings.go:1013-1030 (commit eea235b)
Evidence:    The method nil-checks `override` FIRST, before any field access:
```go
if override == nil {                       // :1016
    if s.GeoRestriction != nil && s.GeoRestriction.AppOverrides != nil { delete(...) }
    return s.save()                        // returns — no deref
}
if s.GeoRestriction == nil { ... }          // :1023 nil-GeoRestriction handled separately
// override.AllowedCountries accessed only at :1029-1030, after the guard
```
The sole caller (api/geo.go:136-137) always passes a non-nil `&settings.AppGeoOverride{}` (clear uses the separate `RemoveGeoAppOverride`). Both nil-override and nil-GeoRestriction are safe.
Confidence:  verified-static

### C3 — SSD-only apps skip DB dump restoration during DR
BUGHUNT ref: line 69 (v0.30.3)  •  **PRIORITY**
Verdict:     **MOOT (architecture now restores DB unconditionally)**
Current:     backup.go:88 (`GetAppDrivePath`), appbackup/restore.go:431, appexport/restore.go:712, export.go:562, setup/handlers.go:88 (commit eea235b)
Evidence:    Original DR files (restore_drives_linux.go, restore_app_linux.go, restore_scan.go) are gone (slice 8C de-privileged the controller). Every current restore path was enumerated; none is HDD-gated to silently omit an SSD-only DB:
1. **Whole-LXC / setup restore** — disk-recovery + infra-backup restore moved to the host agent (PBS whole-LXC vzdump; setup/handlers.go:88 comment). The setup "restore" mode only pulls config from the hub; there is NO selective DB-dump-restore step at all — DB volumes ride inside the block image.
2. **DB dump flow** (`runDBDumpsInternal`, backup.go:182) iterates `DiscoverDatabases` (docker ps), not HDD presence. `GetAppDrivePath` (backup.go:88-98) returns the HDD path if set, **else explicitly falls back to `systemDataPath`** — SSD-only dumps ARE written/restored, never dropped.
3. **Native + recovery-unit restore** (restore.go:85 `restoreDockerVolumes`, restore_unit.go:74) restore the DB's named postgres/mariadb volume tar regardless of HDD.
4. **`.fab` import** — `restoreDatabase` (appexport/restore.go:712) is gated on `manifest.HasDatabase` (set from docker-ps discovery at export.go:562), **not** HDD.
The HDDPath=="" early-return class of bug cannot occur — the fallback is in the single chokepoint and DB discovery is docker-ps-driven. Bug gone, not migrated.
Confidence:  verified-static

### H5 — SyncFileBrowserMounts no concurrency guard
BUGHUNT ref: line 132 (v0.30.3)
Verdict:     **FIXED**
Current:     controller/internal/web/handlers.go:1366-1439 (commit eea235b)
Evidence:    All public entry points (`SyncFileBrowserMounts`:1366, `SyncFileBrowserMountsReset`:1373) funnel into one private `syncFileBrowserMounts`, whose first two lines are `s.fileBrowserMu.Lock(); defer s.fileBrowserMu.Unlock()`. A real `sync.Mutex` is held across the entire body (config.yaml write, compose write, `down -v`/`up -d`) — not a racy flag. Every caller, including the 4 `go`-launched ones, reaches the file writes only through this function, so it genuinely serializes them.
Confidence:  verified-static

### H6 — PushEvent never records to event history
BUGHUNT ref: line 143 (v0.30.3)
Verdict:     **FIXED**
Current:     controller/internal/notify/notifier.go:213, 223 (commit eea235b)
Evidence:    Inside the `PushEvent` goroutine, `recordHistory` is now called on BOTH terminal outcomes: success (2xx) at :213, and failure (after 3 attempts) at :223. `recordHistory` (:550) writes the ring buffer under `historyMu`; `GetEventHistory` (:526) reads it. The history page now sees real PushEvent traffic.
Confidence:  verified-static

### H7 — PushOnce returns nil for non-2xx
BUGHUNT ref: line 154 (v0.30.3)
Verdict:     **FIXED**
Current:     controller/internal/report/pusher.go:197-227 (commit eea235b)
Evidence:    `if resp.StatusCode >= 200 && resp.StatusCode < 300 { return nil }` then `return fmt.Errorf("hub push-once: HTTP %d", resp.StatusCode)` at :227. A 4xx/5xx now yields a real error. The earlier `return nil` (:200) is only the legitimate "hub not configured" short-circuit.
Confidence:  verified-static

### H8 — tmpFile not closed/synced before rename in DB dump
BUGHUNT ref: line 165 (v0.30.3)
Verdict:     **FIXED**
Current:     controller/internal/appbackup/dbdump.go:267-298 (commit eea235b)
Evidence:    Ordering is now Sync → Close → Stat → Rename, errors checked at each step BEFORE rename:
```go
if err := tmpFile.Sync(); err != nil { os.Remove(tmpPath); return result }   // :267
if err := tmpFile.Close(); err != nil { os.Remove(tmpPath); return result }  // :273
stat, err := os.Stat(tmpPath) ...                                            // :281
if err := os.Rename(tmpPath, finalPath); err != nil { ... }                  // :293
```
The deferred `Close` (:244) is now a harmless double-close. This is the controller's only DB-dump writer (`internal/backup/` delegates to this same `appbackup.DumpOne`), so no second un-fixed copy exists.
Confidence:  verified-static

### H10 — SaveAppConfig stores secrets in plaintext on encryption failure
BUGHUNT ref: line 187 (v0.30.3)
Verdict:     **PARTIAL / LIVE** (the tagged fix added a WARN log but did NOT close the bug — cardinal-rule catch)
Current:     controller/internal/stacks/deploy.go:654-666 (commit eea235b)
Evidence:
```go
if enc, err := crypto.Encrypt(encKey, v); err == nil {
    saveCfg.Env[k] = enc; encryptedCount++; continue
} else {
    // H10 fix: log encryption failure — value will be saved in plaintext.
    log.Printf("[WARN] [stacks] Failed to encrypt env var %q: %v — saving as plaintext", k, err)  // :662
}
}
saveCfg.Env[k] = v   // :665 — FALLS THROUGH: plaintext IS persisted
```
The original complaint had two parts: (a) silent, (b) plaintext-on-disk. (a) is fixed (explicit WARN). (b) is NOT — the code still writes the secret unencrypted to app.yaml. The `// H10 fix` comment is a claim that does not match the mechanism.
Severity (reassessed by consequence): **Low–Medium.** `crypto.Encrypt` (AES-GCM, with `encKey != nil` already required to enter the branch) realistically fails only on a malformed/short key or RNG failure — rare. But when it does, that secret lands in plaintext in app.yaml (0600).
Trigger:    `crypto.Encrypt` returns an error for a sensitive var while `encKey` is non-nil (malformed/wrong-length key, RNG failure).
Impact:     One or more app secrets (DB/admin passwords) stored unencrypted in app.yaml, with only a WARN log.
Fix sketch (NOT applied): replace the fallthrough with a fail-closed `return fmt.Errorf("encrypting %q: %w", k, err)` so no plaintext is persisted (or skip the var). Note this is co-located with the CTRL-T2-1 deploy-lifecycle change — sequence them together (see Part 4).
Confidence:  **verified-by-test** — `internal/stacks/saveappconfig_h10_reconcile_test.go` (this branch). With a 5-byte key, `SaveAppConfig` logs the WARN and writes `DB_PASSWORD: supersecret-pw-do-not-leak` to app.yaml; the test asserting no-plaintext FAILS. Run: `cd controller && go test ./internal/stacks/ -run H10 -v`.

## Part 2 — MOOT bucket confirmations (+ migration checks)

### C1 — Watchdog unlock/relock panic-unsafe → checked the agent migration
Verdict:  **MOOT** (migrated, but WITHOUT the bug)
Evidence: Controller `internal/monitor/watchdog.go` is gone. The agent watchdog `/e/git/felhom-agent/internal/storage/watchdog.go` was read in full: `tick()` probes liveness OUTSIDE the lock (:250-257), takes `w.mu.Lock()` only for the in-memory state diff/debounce (:261-327), `Unlock()`s once at :327, then runs all side-effects (report trigger :336, `Remount` dispatched to a goroutine via `w.spawn` :342, `onAbsent` :349) AFTER unlocking. There is no `Unlock(); call(); Lock()` sequence and no `defer Unlock()` over a panicking call. The one IO/panic-prone op (remount) is handed to a background goroutine off the lock path. The double-unlock-on-panic pattern does not exist in the migrated code.

### H9 — Restic retry reused a possibly-expired context → checked agent backup
Verdict:  **MOOT** (restic retired; no equivalent retry migrated)
Evidence: Controller `internal/backup/restic.go` gone. Agent backup `/e/git/felhom-agent/internal/backup/runner.go:100-130` is a single linear flow (`Vzdump` → one `WaitTask(ctx, upid, {Timeout:30m})` → `latestArchive`); on error it returns immediately — no retry-after-unlock, no retry reusing a parent context. `watchForSnapshot` re-polls but returns on `ctx.Done()`. `internal/pbs/` has no retry/backoff at all. The H9 expired-context-retry pattern did not survive.

### H11 — settingsCrossBackupHandler missing dest validation
Verdict:  **MOOT** (handler gone; replacement validates)
Evidence: The original unvalidated cross-drive-backup web handler (web/handlers.go:947-994) is gone — no `CrossBackup`/`settingsCross*` HTTP handler exists in controller/internal/web or /api. The replacement `internal/web/tier2_config_handler.go` validates the POSTed `target` (:59) against the eligible registered-drive allowlist before saving (:61-77), with a runtime re-validation in the runner. Remaining `CrossDrive` references are settings/config/notify plumbing, not path-accepting handlers.

### File-gone Lows (one stroke)
| ID | Original | Verdict |
|---|---|---|
| L7 | backup/crossdrive.go double-clear running map | CODE-GONE (not migrated) |
| L8 | backup/restic.go uint64→int64 cast | CODE-GONE (restic retired) |
| L9 | backup/restic.go empty error parse | CODE-GONE |
| L11 | backup/restore_drives_linux.go fstab TOCTOU | CODE-GONE (agent has read-only mounts only; fstab deferred in agent docs) |
| L12 | backup/restore_drives_linux.go non-atomic fstab | CODE-GONE |
| L14 | backup/restore_app_linux.go hardcoded 0644 | CODE-GONE (the 0644 in backup/recovery_unit.go is new Tier-2 code using atomicWrite, unrelated) |
| L18 | backup/restore_scan.go picks first not freshest | CODE-GONE (no restore-scan/freshest logic in agent) |

## Part 3 — Medium/Low mechanical triage (existence only; survivors NOT deep-verified)

**Cross-ref:** survivors that overlap the fresh audit's "What was NOT covered" are flagged **[backlog]** — genuinely unexamined. Survivors the fresh audit already verified/fixed are flagged **[audit:…]**.

### Mediums
| ID | survives? | current file:line | note |
|---|---|---|---|
| M1 | SURVIVES | cmd/controller/main.go:769 | **already uses `subtle.ConstantTimeCompare`** (also csrf.go:40,65) → effectively addressed |
| M2 | SURVIVES | internal/backup/backup.go:122,259,331 | **LIVE = fresh-audit CTRL-T3-1** (unlocked `stackProvider` read; benign, init-only write) |
| M3 | SURVIVES | internal/settings/settings.go:934 | **[audit: FIXED]** drains only after successful save |
| M4 | SURVIVES | internal/stacks/deploy.go:59 (`SubdomainInUse`) | **[backlog]** I/O under RLock — not re-verified |
| M5 | SURVIVES | internal/stacks/manager.go:128 (`MigrateEncryption`) | **[backlog]** encKey lock — not re-verified |
| M6 | SURVIVES | internal/stacks/manager.go:128 | **[backlog]** lock-during-I/O (startup-only; likely benign) |
| M7 | GONE | — | `executeAllRestores`/web/handler_restore.go deleted (8C) |
| M8 | SURVIVES | internal/web/auth.go:113 | **[audit: partial — CTRL-009]** a limiter now exists but is XFF-spoofable |
| M9 | SURVIVES | internal/api/router.go:161+ | **[audit: addressed]** `extractName` rejects empty/`..` (fresh audit confirmed) |
| M10 | SURVIVES | internal/scheduler/scheduler.go:76,102,130 | **[audit: FIXED]** late-registration launches goroutine immediately |
| M11 | GONE | — | monitor/watchdog.go deleted; no `findStoragePath` |
| M12 | GONE | — | monitor/watchdog.go deleted |
| M13 | SURVIVES | internal/metrics/store.go:27 | **[audit: FIXED]** WAL mode now verified |
| M14 | SURVIVES | internal/metrics/collector.go:99 | **[audit: FIXED]** uses parent ctx, not Background |
| M15 | SURVIVES | internal/metrics/telemetry.go:42 | scan error now logged (not silent) |
| M16 | GONE | — | crossdrive.go deleted (`copyStackDBDumps`) |
| M17 | GONE | — | restic stats removed from backup.go |
| M18 | SURVIVES | internal/appbackup/dbdump.go:425 (`ListDumpFiles`) | **[backlog]** re-validates every dump — moved, not re-verified |
| M19 | SURVIVES | internal/appbackup/dbdump.go:536 (`deriveStackName`) | **[backlog]** naive suffix-strip — moved, not re-verified |
| M20 | GONE | — | crossdrive.go deleted (`syncInfraConfig`) |
| M21 | GONE | — | no `http.Get` anywhere |
| M22 | SURVIVES | internal/assets/syncer.go:78 | **[audit: FIXED]** lock is a running-guard; download lock-free |
| M23 | SURVIVES | internal/sync/sync.go:433 | `maskRepoURL` now applied at the log site → addressed |
| M24 | GONE | — | old storage_handlers.go:953 path-prefix code gone (only `/mnt/` guards remain) |
| M25 | SURVIVES | internal/web/server.go:128+ (`Set*`) | **[backlog]** init-order, like CTRL-T3-1/M2 — not re-verified |
| M26 | SURVIVES | internal/crypto/crypto.go:103,112 (`DecryptMap` global `log`) | **[backlog]** cosmetic logger inconsistency |

### Lows
| ID | survives? | current file:line | note |
|---|---|---|---|
| L1 | SURVIVES | cmd/controller/main.go:1172 (`fileExists`) | **[audit: dead-code]** unused (also in fresh audit's dead-code inventory) |
| L2 | SURVIVES | cmd/controller/main.go (multiple `go func`) | **[backlog]** no WaitGroup for shutdown |
| L3 | SURVIVES | internal/config/config.go:258 | `0`=unset sentinel present |
| L4 | SURVIVES | cmd/controller/main.go:189 | hardcoded metrics DB path |
| L5 | SURVIVES | cmd/controller/main.go:57 | hardcoded config-flag default |
| L6 | SURVIVES | cmd/controller/main.go:117 | string-concat path |
| L7–L9, L11, L12, L14, L18 | GONE | — | (Part 2 file-gone bucket) |
| L10 | GONE | — | infraPaths gone from backup.go |
| L13 | SURVIVES | internal/backup/backup.go:484 | 10s DB-inspect timeout present |
| L15 | GONE | — | snapshot/restic history gone |
| L16 | GONE | — | `RunIntegrityCheck` gone (restic tier removed) |
| L17 | SURVIVES | internal/backup/backup.go:95 | empty drive-path warn present |
| L19 | SURVIVES | internal/appbackup/dbdump.go:478,517 | throwaway exec for logging |
| L20 | SURVIVES | internal/appbackup/dbdump.go:320,333 (`ValidateDump` global `log`) | **[backlog]** |
| L21 | SURVIVES | internal/stacks/healthprobe.go:337 (`methodOrEmpty`) | moved to stacks/ |
| L22 | SURVIVES | internal/stacks/manager.go:468 (`aggregateState`) | **[backlog]** StatePaused handling — not re-verified |
| L23 | SURVIVES | internal/stacks/manager.go:830 | **[backlog]** composeExecCustomEnv env double-load |
| L24 | SURVIVES | internal/stacks/manager.go:930 (`logPostStartStatus`) | **[backlog]** goroutine no cancel |
| L25 | SURVIVES | internal/stacks/delete.go:510 (`ParseComposeHDDMounts`) | **[audit: mitigated]** traversal cleaned (C10 fix), naive-YAML still present |
| L26 | SURVIVES | internal/stacks/delete.go:574 (`getDirSizeHuman`) | **LIVE = fresh-audit CTRL-T2-5** (no timeout) |
| L27 | SURVIVES | internal/stacks/delete.go:80/283 + ScanStacks | **[backlog]** double update path |
| L28 | SURVIVES | internal/stacks/manager.go:591-593 | **[audit: FIXED]** Options now deep-copied (H12 fix) |
| L29 | SURVIVES | internal/web/server.go:327,363 (`serveCatchAll`) | **[backlog]** double WriteHeader |
| L30 | SURVIVES | internal/web/auth.go:219,236 | **[backlog]** CSRF token not rotated |
| L31 | GONE | — | old storage_handlers.go:1490 Content-Type code gone |
| L32 | SURVIVES | internal/web/alerts.go:54 | variadic API (cosmetic) |
| L33 | SURVIVES | internal/web/funcmap.go:329 | **[audit: reviewed]** `json` func suppresses marshal error (no XSS — html-escaped) |
| L34 | GONE | — | monitor/pinger.go deleted |
| L35 | SURVIVES | internal/metrics/store.go:19 | **[backlog]** no SQLite conn-pool limits |
| L36 | SURVIVES | internal/metrics/store.go:312 | **[backlog]** no WAL checkpoint after Prune |
| L37 | SURVIVES | internal/cloudflare/countries.go:253 | rebuilds sorted list (cosmetic perf) |

## Part 4 — Merged, severity-ordered fix list

Combines the 3 validated fresh findings with every LIVE old finding (H10) + the LIVE survivor M2. Severity reassessed by consequence.

| # | ID | Title | Repo | Location (file:line @ commit) | Severity (reassessed) | Effort | Fix sketch |
|---|---|---|---|---|---|---|---|
| 1 | CTRL-001 | Import path traversal via unvalidated `manifest.AppName` | controller | appexport/restore.go:339,365,401 @ eea235b | **High (Critical-adjacent)** | S | Reject `AppName` unless single safe segment (`^[a-z0-9][a-z0-9-]*$`); same for archive subdir/config-file names |
| 2 | CTRL-T2-1 | `app.yaml` persists `Deployed:true` before `compose up -d` → ghost-deployed stuck stack on crash | controller | stacks/deploy.go:294-330 @ eea235b | High | M | Persist `Deployed:false`/a `deploying` flag before compose; flip true only after success; or startup-reconcile zero-container recent-deploy → failed |
| 3 | H10 | SaveAppConfig persists secret in PLAINTEXT on encrypt failure | controller | stacks/deploy.go:654-665 @ eea235b | Low–Medium | S | Fail-closed: `return err` instead of falling through to plaintext write |
| 4 | AGENT-001 | Inline customer-confirmed wipe formats mutable `/dev` path (classify→mkfs TOCTOU) → wrong-disk wipe | agent | localapi/disks.go:429-471 @ d17b5ab | Medium (data-loss consequence) | M | Re-resolve durable→path + re-inspect immediately before Format (mirror `WipeExecutor.Execute`) |
| 5 | M2 / CTRL-T3-1 | `backup.Manager.stackProvider` read without the mutex that guards its write | controller | backup/backup.go:89,122,259,331,400,491 @ eea235b | Low (benign; init-only write) | S | Drop the pointless lock on the init write, or add a locked accessor for the 11 reads |

**CTRL-001 severity note (Critical vs High):** it is an arbitrary-directory write as the controller process (root-in-container). On the no-password demo posture, import is reachable unauthenticated, and a written `docker-compose.yml` placed in a stacks path can later be deployed → effectively code-execution-within-container. That argues **Critical**. It is bounded by the de-privileged container and (on password-set deployments) RequireAuth+CSRF, which argues **High**. Verdict: **High, treat as Critical operationally** — and it is the cheapest fix on the list, so it goes first regardless.

### Recommended fix order + rationale
1. **CTRL-001 first** — trivial (one validator) for the highest security consequence; remove the arbitrary-write primitive before anything else.
2. **Deploy-lifecycle slice: CTRL-T2-1 + H10 together** — both edit `stacks/deploy.go` (the deploy goroutine + `SaveAppConfig`). **They INTERACT — sequence them in one slice/PR to avoid merge conflict.** H10 is the smaller change (fail-closed return); fold it in while restructuring the deploy/save ordering for CTRL-T2-1. Net: deploy state is honest on crash AND no plaintext secret can be written.
3. **AGENT-001 — spike-first, isolated review.** It is the only change touching the DESTRUCTIVE wipe path; do a focused spike (adopt the `WipeExecutor` resolve→re-derive→re-inspect-before-Format structure) and review it in isolation on the agent repo. Do NOT bundle with controller work. The live USB-reenumeration race is hard to reproduce — fix by code-structure parity with the already-correct signed-jobs path, not by chasing a live repro.
4. **M2 / CTRL-T3-1 last** — trivial cleanup; benign today (init-only write). Opportunistic, or fold into a `-race`-driven cleanup pass.

## Part 5 — Next-session plan

First fix slice: **CTRL-001** (add the path-segment validator — minutes, highest consequence) then the **deploy.go slice (CTRL-T2-1 + H10)** since they are co-located and both touch deploy/SaveAppConfig. Hold **AGENT-001** for a separate spike + isolated review on the agent repo (structure-parity with `WipeExecutor`, no live-repro dependency). Runtime confirmation still wanted before/after: a one-shot CTRL-T2-1 repro (kill the controller during a large-image deploy, confirm the ghost-deployed state, then re-confirm the fix clears it) — AGENT-001 and H10 need no runtime repro (both have static/structural fixes; H10 has a failing unit test that will flip green).

## Session notes, assumptions, what was NOT verified

- **Cardinal rule paid off on H10:** the `// H10 fix` tag claimed a fix that the mechanism does not deliver. All other fix-tags (C2/C03, H5, H6, H7, H8) were verified to match their mechanism.
- **MOOT proofs included migration checks** (per the mandate): C1 → agent `storage/watchdog.go` read in full (panic-safe inverse pattern, no bug); H9 → agent `backup/runner.go` + `pbs/` (no retry-reusing-context); H11 → replacement `tier2_config_handler.go` validates dest.
- **Part 3 is existence-only** (per task) — survivors flagged `[backlog]` are NOT verdicted FIXED/LIVE; they are the genuinely-unexamined set for a future deep pass. The `[backlog]` Mediums most worth a look: M4/M5/M6 (stacks lock-during-I/O), M18/M19 (appbackup dump validation/naming), M25 (web Server Set* init-order, same class as M2).
- **Assumption:** "one customer per host" / de-privileged single-tenant container (affects CTRL-001's Critical-vs-High framing and the exposure of M2/CTRL-T3-1).
- **Not verified (out of scope for reconciliation):** the deep mechanism of every surviving Medium/Low (Part 3 is a triage, not an audit); any runtime/`-race` confirmation (none run this session).
- Two evidence tests written, both FAIL at the recorded commit: controller `internal/stacks/saveappconfig_h10_reconcile_test.go` (H10). (The fresh-audit branch already carries CTRL-001 and AGENT-T2-1 evidence tests; not duplicated here.)
- No production source modified; BUGHUNT.md / AUDIT-2026-06-13.md / CHANGELOG / README / CONTEXT / REPORT untouched.