felhom.eu/REPORT-burndown2-2026-10-16.md

# REPORT — burndown 2: Data tab leftovers, plain http closed, the hub-key door removed, Go 1.27.2, the dead install-form branches (2026-10-16)

Written in ASD-STE100 Simplified Technical English. Operator brief „burndown 2", operator present.
Design read first: `architecture/01-topology-and-trust.md` §4 and §10 (now records R-970), `04-control-plane-authorization.md`,
`09-update-architecture.md` §0 and the release rule. Evidence: `documentation/audits/burndown2-2026-10-16/`.

## 0. A decision I took (inside the brief; reversible)

**The controller runtime stays on Debian 12 (12.13, all fixes) — not Debian 13.** The brief said „the current Debian
stable". Debian 13 changes restic, the off-site backup engine, from 0.14.0 to 0.18.0. The off-site code relies on
measured 0.14.0 behaviour (a missing source path is only a warning, the progress output, the clean-up windows,
restore without a lock). Changing it silently changes how customer backups behave. The Go toolchain and every fixable
OS package are updated; the Debian 13 move is its own row with the re-proof (R-1105).

## 1. Each part

| Part | Result |
|---|---|
| 1 — Data tab leftovers | **Done** (controller 0.322.0). The export password field: `autocomplete="new-password"`, name `fab_encryption_key`. The 2nd copy's status rows are gone; the form is the one place (its no-target reason moved into it); the warning stays. Browser (headless Chrome through the public address): the field renders with the attribute and stays empty; no status rows; one target label. **Headless Chrome has no saved passwords, so the autofill itself is not proven — the attribute is.** `P1/` |
| 2 — plain http (R-1033, P1) | **Closed.** The hub's newest reports: demo-hp, Tester 1, demo-felhom on ≥ 0.321.0. `https_only_check.py`: 35 public names → 301 on all three. **Tester 2** (`sajatfelhom.hu`, 0.292.0, off since 2026-10-04) is not checked: both http and https answer Cloudflare 530 (tunnel down). R-1104 checks it when it returns. `P2/` |
| 3 — the box settings route (R-970, P2) | **Closed.** See §3. |
| 4 — Go and base images (R-972, P2) | **Controller released, hub deployed on your yes, agent committed (no release).** See §4. |
| 5 — dead install-form branches (R-1103, P4) | **Closed.** The installed-only branches of `app_fields.html` removed. Retired tests and where their rule is now: `TestDeployPage_DeployedApp_DoesNotCarryTheSecret` → `TestAppPage_LoginPairPanel` + `TestR255_NoPlantedSecretReachesAnyPage`; `TestR709_AnInstalledAppsPasswordIsNotInThePage` → the same two (its install-form half stays as `TestR709_TheInstallFormKeepsItsGenerator`); `TestR694_TheDeployPageDoesNotOfferAGeneratedLogin` → `TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin` (new, red-proved); the parity cases `deploy_installed` and `deploy_installed_restored`. |

## 2. https check per box (`P2/https-only.txt`)

tester-1 13 names, demo-hp 14, demo-felhom 8 — each `http://` → 301 to the same `https://` address; the negative
control convicted. Tester 2: not checked (530, off).

## 3. The removed route (R-970)

- **What:** the routes that read and replaced the box's settings file, and the hub-key access to the self-update and
  geo routes (the dashboard keeps using those with a session). The matching CSRF exemption for the hub key is gone.
- **Nothing called them:** no caller in the hub (it never connects into a box; its geo switch goes to Cloudflare
  directly), the agent, the controller's own pages, or any script in the five repos. The hub README listed „Push/Pull
  Config", „Show Diff" and „Trigger Update" — no code exists for them; the four rows are removed.
  `02-controller-module-map.md` marked config-apply as needing rework, not as a planned use.
- **Proof:** the route table is now one function (`buildMux`), and `TestR970_HubKeyOpensNoDoor` drives that real table
  with real servers: every method on every former door, with the box's key and no session, is refused, and a planted
  settings file is neither served nor changed. Plus `TestR970_ConfigRoutesAreGone` and
  `TestR970_HubKeyIsNoCSRFExemption`. Each red-proved (`redproof/`). **Live on demo-hp:** every former door answers 401
  with the box's own key (read inside the box, never printed); `/api/health` 200 (`P3/live-door-check.txt`).

## 4. Go and base images (R-972)

| | before | after |
|---|---|---|
| controller binary | Go 1.24.13, x/crypto v0.31.0 | **Go 1.27.2, x/crypto v0.58.0** |
| controller runtime | `debian:bookworm-slim` | **`debian:12.13-slim@sha256:67b3…` + `apt-get upgrade`** (restic stays 0.14.0) |
| controller builder | `golang:1.24-bookworm` | `golang:1.27.2-trixie@sha256:4766…` |
| hub | Go 1.24.13, x/crypto v0.31.0, `alpine:3.21` | **Go 1.27.2, x/crypto v0.58.0, `alpine:3.24.2@sha256:294b…`** (builder `golang:1.27.2-alpine3.24@sha256:f92b…`) |
| agent | Go 1.26.0 (binary 0.158.1), x/crypto v0.52.0 | `go.mod` Go 1.27.2, x/crypto v0.58.0 — committed, **not released** |

Scanners (the review's own tools: trivy 0.74.0, govulncheck v1.1.4):

| image | critical (fixable) | high (fixable) | govulncheck on the binary |
|---|---|---|---|
| controller 0.321.0 (before) | 16 (12) | 200 (64) | 62 |
| controller 0.322.0-rc.3 = the release's commit | **4 (0)** | **140 (4)** | **1** |
| hub 0.155.0 (before) | 0 (0) | 36 (36) | 62 |
| hub 0.156.0 | **0 (0)** | **0 (0)** | **1** |

The 4 remaining fixable highs are in Docker's own `docker-compose` plugin (its Go), not ours. The one govulncheck note
is `x/crypto/openpgp`, a package neither program links (`go mod why`), reported at module level. Full suites green on
Go 1.27.2 in all three repos (the i18n parity suite included).

**Restic, measured on demo-hp:** an off-site backup with restic 0.18.0 (rc.1, Debian 13) — „backup OK", 172 snapshots;
then with 0.14.0 (rc.2) on the same store — „backup OK", 186 snapshots. The store stays readable both ways; the other
0.14.0 assumptions are not measured on 0.18 → R-1105.

## 5. Versions, commits, fixtures, rows

- **felhom-controller** `8fe46a1` → `f037be7` (R-970, Data tab, R-1103) → `fc77fcb` (Go 1.27.2) → `52619e8`
  (Debian 12.13) → `e9d0d72` (CHANGELOG, `apt-get upgrade`) → docs. Test images rc.1 (Debian 13), rc.2, rc.3 (demo-hp
  only); release **0.322.0**, MinAgent 0.158.1.
- **felhom.eu** `836d64ef` → `9d6f3b46` (hub 0.156.0) → this commit. **Hub 0.156.0 deployed** on the operator's yes
  (`6999c15f`, manifest tag only): see §5a.
- **felhom-agent** `dd8b2ac` → `37b99d7` (Go 1.27.2, not released).
- **Fixtures re-captured (8):** `app_data_deployed`, `app_data_export`, `app_data_notarget_disabled`,
  `app_data_target_auto`, `app_data_target_ssd`, `deploy_new`, `deploy_new_blocked`, `deploy_new_memory_blocked`
  (the last three: whitespace only, plus one test-data option production never renders). **Removed (2):**
  `deploy_installed`, `deploy_installed_restored`. Every other fixture byte-identical.
- **Rows: before 175, after 174. Closed 3** (R-1033, R-970, R-1103). **Opened 2** (R-1104, R-1105). R-972 NARROWED.

**The release (`release/`):** Tester 1, demo-hp and demo-felhom took 0.322.0 through per-box floors (all three on it at
19:01). Nothing unhealthy, restarting, exited or created; the three dashboards 200; https-only 35 names OK; restic 0.14.0
in each controller. **Global floor 0.322.0 / MinAgent 0.158.1** at 19:04:50 (`303` → `flash=floor_set`); the three
per-box floors cleared. Read back on two channels: the hub's own `/configuration` page, and one `tar` of `hub.db` +
`-wal` + `-shm` (integrity ok, newest report 12 min old): `min_controller_version` 0.322.0, `…declared_min_agent`
`0.322.0=0.158.1`, the three per-box floors empty.

## 5a. The hub deploy (operator's yes, 2026-10-16)

`manifests/hub.yaml` tag 0.155.0 → 0.156.0 (`6999c15f`). ArgoCD hard refresh: only `Deployment/hub` out of sync; only it
was synced. Synced/Healthy at the pushed revision; the pod runs `felhom-hub:0.156.0`, 0 restarts; its log says
`felhom-hub 0.156.0 starting`, no error line. **Positive observables:** reports from demo-felhom, demo-hp and Tester 1 at
19:27 and 19:31 (the hub's log); the hub's `/configuration` page (HTTP 200) shows 0.322.0 and 0.158.1
(`release/hub-page-floor.txt`); a database copy with its WAL after the start (`release/hub-0.156.0-after-deploy.txt`).
**CI:** every commit of this task green by job. The controller docs commit failed first (job 1959): its CI read the
register before the felhom.eu push that added R-1105; re-run after that push, green.

## 6. Observations

1. Tester 2 is not checked for plain http while it is off. FILED: R-1104
2. Debian 13 would move the off-site engine to restic 0.18.0 with assumptions measured on 0.14.0. FILED: R-1105
3. govulncheck names `x/crypto/openpgp` in both new binaries. NOT-A-FINDING: neither program links it (`go mod why`: not needed); the report is module-level because the binaries are stripped.
4. The parity case `deploy_new_memory_blocked` set „the current drive is missing" on a NOT-installed app, which the handler never does. NOT-A-FINDING: test data only; the re-captured fixture now shows what production renders.
5. The Samba image (48 fixable high in the review) was not rebuilt in this task. NOT-A-FINDING: it is already named in R-972, which stays NARROWED for it.

## 7. Teardown (three layers)

- **Machine:** demo-hp 9201 ran rc.1, rc.2, rc.3, then the release by the floor; two by-day backup runs (off-site
  included). The door-check script ran inside the controller container and was removed; the key never left the box.
- **Host:** nothing.
- **Hub:** per-box floors set and cleared; the global floor raised (the release). Hub 0.156.0 deployed (only `Deployment/hub` synced).