felhom.eu/REPORT-day-2026-10-19.md

# REPORT — day 2026-10-19

The operator answered the two STOPs in advance („YES to the agent and the hub release") and earlier: golden 0.331.0
vouched; D16 (one sign-in) yes; D17 „one per day, 3 days". No question was asked during the session.

## In plain words

- **Agent 0.160.0 runs on all three test hosts.** A new recovery code replaces the old one only after the household types
  two of its words back; a broken-into box cannot flood the whole-box backups; the local copies are one per day for 3
  days; an empty partition does not ask „data will be erased". **It is not vouched — that is yours.**
- **One sign-in for the file manager is live on every box** (controller 0.332.0, the floor). „Fájlok ↗" opens the app's
  folder with no second login. A sign-out on the dashboard asks again. No app on the box can pretend to be the household.
- **Hub 0.159.0 is live.** A refused backup has its own alarm text. A reinstall over an old host record now mails you; it
  does not re-issue the codes by itself (a security review stopped the first draft that did).
- **The preview error (R-1153) was a broken test file**, not the box.
- **The old backup program still reads demo-hp's off-site copies** after the first real clean-up with the new one.

## 1. Agent 0.160.0 (R-978, R-973, R-1093, R-1149, R-1151) — `audits/day-2026-10-19/P1/`

- **Content:** R-978 (an abandoned second ceremony keeps the first code), R-973 (the cadence cap: daily tier 3 per 24 h,
  off-site 1 per 6 days), R-1093 (an empty partition is not data), **R-1149** (local tier `keep-daily=N`, operator D17),
  **R-1151** (the package uploads only at `POST /escrow/ceremony/confirm` with two typed words; a claim without
  `defer_upload` keeps the R-978 order, so an old controller still completes a ceremony). Commits `1b6e316`, `c11e3e2`,
  `124164d` (CHANGELOG), `4545819` (two texts, after the release, unreleased). Released with `release-agent.sh`: sha256
  `7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1`, bundle
  `6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f`, round trip verified, tag `v0.160.0`.
- **Red-proofs:** keep-last for the primary → „primary tier prune = "keep-last=3"" and „holds 0 copies made before the
  compromise"; the claim's defer flag ignored → „a code that was shown but never typed back replaced the package: code 1
  no longer opens it (uploads=2)" (all three abandon paths); the word check skipped → „one wrong word: got 200".
- **demo-hp proof** (signed jobs 01:22 UTC, running 01:23, „update committed" 01:24; probe 75/75):
  - a normal „Mentés most" of 9201: green, 6.9 GB in 443 s; yesterday's copy pruned (keep-daily=1, the same copy keep-last
    would prune); the cap's history on disk holds both successes;
  - escrow through the wizard's own calls: ceremony 1 — one wrong word 422, the right words 200; code 1 opens the hub's
    package, code 0 is a kept earlier one (422, superseded at the confirm second 01:47:47). Ceremony 2 shown and abandoned —
    code 1 still opens it (200), code 2 opens nothing (400). demo-hp's stored code is now code 1 (CC's secret store);
  - R-1093 on the real route: a 64 MB RAM disk (`scsi_debug`, `/dev/sdb`), one empty GPT partition → `POST /disks/format`
    → 200 formatted, no confirmation; control: the same partition, now ext4 → 403 `needs_confirmation`. RAM disk removed.
    **A loop device cannot be used:** the route and the probe accept only sd/nvme/vd/hd names (by design).
- **The answer:** the operator's „yes" (in advance). Tester 1 and demo-felhom took 0.160.0 by signed jobs (01:52 UTC →
  01:54 / 01:55, probe 75/75, `keep-daily=3` armed on both); the hub's host rows read 0.160.0 for all three, and fresh
  reports after the hub restart. **Old controller with the new agent:** pinned by `TestEscrowCeremony_R1151_OldControllerKeepsTheClaimOrder`; **new controller with agent 0.159.2:** pinned by `TestR1151_OldAgentClaimCompletesAtOnce` and the agentapi test — no host runs 0.159.2 any more, so not walked live.

## 2. One sign-in (R-1100) — `audits/day-2026-10-19/P2/`, `P4/05-*`, `P4/06-*`

- **Built** exactly the design note's recommendation (controller `9bdd8f8`, `601bdba`): the dashboard pass, the host-only
  files cookie (derived from the session fingerprint, the R-976 shape), the per-box secret header name, the forwardAuth
  answer; header user `felhom-household` with the household's file rights from userDefaults; `logoutRedirectUrl` = the
  dashboard; `admin` stays a password user; the data tab's „asks for its own password" note only without the sign-in.
- **Tests, each red-proved:** replayed pass, expired pass, pass for another host (two guards: the host check and the
  host-bound session key — red only with both removed), wrong X-Forwarded-Host, no session → no pass, signed out → asks
  again (and after a password change), cross-site → no pass, dot-segments in `to`, the absolute redirect, the config
  trusts only the secret name, the header user's rights, the route asks the controller and strips the header, the note.
- **Live, found and fixed before release:** on rc.2 the pass answer's relative redirect became
  `http://felhom-controller:8080/files/` — traefik resolves a forwardAuth answer's Location against the auth server. Fixed
  (absolute), red-proved, rc.3. A background security review then flagged CSRF and revocation: `/__files/open` now refuses
  a cross-site request and dot-segments; the revocation residual is R-1155.
- **Live proof (rc.3, 9201, headless Chrome through the public names mapped to the box):** signed in → calibre-web's
  „Fájlok ↗" → FileBrowser at `NVME 1TB/media/books`, no login form, user `felhom-household` (admin false, modify true,
  login method proxy); signed out → `files.<domain>` went to the dashboard login. Screenshots `browser/01-…`, `02-…`,
  `03-…`. Forged headers (`forged-headers.txt`): through traefik with no cookie — the old public name, a random name and the
  REAL secret name all 401; from the bookstack container straight to `filebrowser:80` — the old name and a random name 401;
  control: the real name from the same container 200 (the protection is the name's secrecy). The brief named Nextcloud;
  bookstack was used (an app on 9201's network with curl).

## 3. Preview check (R-1153) — `audits/day-2026-10-19/P3/`

On 9202 (controller 0.331.0): OnlyOffice installed, the link on (FileBrowser back in 4 s). The hand-made `teszt.docx`
(912 bytes) → 500 „fitz: cannot open document"; OnlyOffice's own `sample.docx` → **200, a 256×256 JPEG, 0.3 s**. Same with
the link OFF. FileBrowser 1.5.6 previews .docx with its own MuPDF before OnlyOffice (`preview.go` `determinePreviewType`).
**Closed: not a product defect.** OnlyOffice removed through the product (both volumes gone), test files deleted.

## 4. Controller release 0.332.0 — `audits/day-2026-10-19/P4/`

Image `0.332.0` from `601bdba` (digest `sha256:245266a4…`), 03:16 UTC. Per-box floors 03:16:43 → Tester 1 and demo-felhom
on 0.332.0 at 03:16:45–55, demo-hp (from rc.3) at 03:17. Box walk on all three: 0 unhealthy, 0 allow-list refusals,
FileBrowser re-published 6 s after its re-create, public pages 200; https-only 28 OK, 0 failures, both controls right.
„Fájlok ↗" with no login through the public internet on demo-hp and Tester 1 (pass → cookie → `felhom-household`; a fresh
browser 401; sign-out → back to the dashboard). demo-felhom: CC holds no dashboard password for the lived-in box, so its
check is the files (secret 0600, config and route carry it) and the refusals (forged secret name through traefik 401, old
name from outside 401, a forged pass 403). **Global floor 0.332.0 / MinAgent 0.158.1 at 03:24:18 UTC**, read back with the
WAL; per-box floors cleared (read back empty). MinAgent 0.158.1 ≤ the vouched agent 0.159.2. i18n fixtures changed (named):
`escrow_first`, `escrow_receremony`; all others byte-identical. No golden (decision 250); the floor is above golden 0.331.0
until Sunday's bake.

## 5. Hub 0.159.0 (R-1150, R-1154) — `audits/day-2026-10-19/P5/`

- Written by a helper (`5121536f`, `b505ce4b`). **R-1154's rule, and why:** the helper's first draft re-issued the claim
  code and the off-site provider password automatically when the old host was stale or switched off. A background
  security review flagged it; the helper then read what the retrieval passphrase already grants (`/config` → the
  controller API key; the enroll → the host key) and found the re-issues are the operator's session-only powers
  (decision 252). So the passphrase must not reach them: **the reuse path re-issues nothing; when the old box looks gone it
  mails the operator** („delete the old host and run the installer again, or re-issue …"), a live box gets an info record.
  The operator's delete stays the gate. **R-1150:** `whole_guest_backup_refused` (operator-only, hub-origin; NOT in
  `allowedEventTypes`, against the brief's wording — the suspected controller must not post or pre-empt it, R-895's
  shape). Tests red-proved (helper's list in `hub/CHANGELOG.md`).
- **A push blocker on the way:** R-887's dated check was due today. Measured: 381 CI jobs since the S21 change, 0 lost (the
  three re-runs' first attempts ran 47–49 s; control: the known lost attempt of 2026-10-10 ran 11 min 48 s and the attempt
  count finds it). Closed.
- **Deploy:** image from a clean clone (the shared checkout held my uncommitted evidence), manifest `200ab653`, ArgoCD
  synced the hub Deployment only (the only OutOfSync resource), Synced/Healthy, no ERROR, the floor read back, then fresh
  reports from all three hosts (02:23–02:25 UTC) and all three controllers (02:29–02:31 UTC).

## 6. The old-restic check — `audits/evening-2026-10-18/P8/old-restic-check.txt`

The night watcher ran it: window 12 at 02:18 UTC removed 63 of demo-hp's 324 copies (→ 261); the old restic (0.14.0) and
the new (0.19.1) both list 261 and restore a 0.19.1-made copy and an August copy to identical content hashes. STATUS item
closed; `REPORT-evening-2026-10-18.md` §9 filled.

## 7. Versions, commits, fixtures, rows

- Agent **0.160.0** (released, not vouched) — `1b6e316`, `c11e3e2`, `124164d`, `4545819`. Controller **0.332.0** (floor) —
  `ba4a6f0`, `9bdd8f8`, `601bdba`; rc.1–rc.3 on 9201 only. Hub **0.159.0** (deployed) — `5121536f`, `b505ce4b`, manifest
  `200ab653`. felhom.eu `afc939bb` (R-887), `5622ce27`, this commit. Catalog: none.
- Fixtures: `escrow_first`, `escrow_receremony` (controller); no other page changed.
- **Register: 168 before, 166 after; closed 10** (R-887, R-978, R-973, R-1093, R-1149, R-1151, R-1100, R-1153, R-1150,
  R-1154), **opened 8** (R-1155 … R-1162).
- `unproven.py --summary`: not walked 35 of 55 — unchanged. Capability map: not changed. System poster: text only — the
  local whole-guest „Kept" cell („one copy per day, up to 3 days") edited in both the facts file and the drawing.

## Observations

1. FileBrowser's own 2-hour token can outlive the dashboard session if only the files cookie is lost. FILED: R-1155.
2. A reinstall within 45 min of the old box's last report reads „live" (no mail). FILED: R-1156.
3. Repeated cap refusals inside the 24 h hold raise no new alarm. FILED: R-1157.
4. The off-site leg of the clean-slate re-issue may be obsolete since hub v0.127.0. FILED: R-1158.
5. The retrieval passphrase yields the controller API key, which registers and confirms off-site keys. FILED: R-1159.
6. Hub and agent have no gofmt gate (~20 and 14 files drift). FILED: R-1160.
7. The escrow wizard calls the code „live" at the reveal; since R-1151 it is live only after the typed-back words.
   FILED: R-1161.
8. R-973's off-site half (ep0 prunes by count) outlives the closed row. FILED: R-1162.
9. traefik resolves a forwardAuth answer's relative Location against the auth server. NOT-A-FINDING: found on rc.2 and
   fixed before the release (red-proved); recorded as a rule in CONTEXT and memory.
10. The ceremony log line and two R-973 comments were stale. NOT-A-FINDING: fixed in agent `4545819` (the size rule).
11. My first OnlyOffice link call sent `{}` and switched the link off. NOT-A-FINDING: my call; the API wants
    `{"enabled": true}`; it was already off, nothing restarted.
12. The R-1093 route refuses loop devices. NOT-A-FINDING: by design (only real disk names are allowed); a RAM disk was used.
13. CC holds no dashboard password for demo-felhom, so its „Fájlok ↗" was not walked as a household. NOT-A-FINDING: the
    lived-in box's household password is not CC's (decision 254); its files and refusals were checked instead.
14. A helper's commits sat unpushed in the shared felhom.eu clone for ~40 minutes (blocked by R-887's due check).
    NOT-A-FINDING: the gate did its job; pushed with my R-887 commit.
15. Two shell scripts of mine were refused by Claude Code's removal check (a cleanup `rm` it could not read behind
    `bash -c`). NOT-A-FINDING: rewritten without the removal; nothing was deleted.

## Teardown — three layers

- **Machines:** 9202 — OnlyOffice removed through the product (volumes gone), test documents deleted; 9201 — on 0.332.0
  (the floor); the escrow test left demo-hp on code 1 (stored); demo-hp host — the RAM disk module removed, helper scripts
  deleted, no file left in `/root` (an older helper, `/root/opens.sh`, removed by name at the end). Cookie jars and
  password files on DooPlex shredded or emptied. One debugging sign-in on demo-hp's dashboard (curl, 03:03 UTC) was not
  signed out; its cookie file is shredded, so the session expires unused.
- **Hub:** global floor 0.332.0 / 0.158.1, no per-box floor; hub 0.159.0; no vouch.
- **DooPlex:** builds (agent, controller rc.1–3 + 0.332.0, hub 0.159.0 from a clean clone) and the hub deploy; no Docker
  cleanup.

Architecture read: `01`, `02` „Logins and folders", `03` §8a, `04`, `05`, `07` §6/§6.1; the design note. Documents changed:
`02`, `03` §8a, `07` §6.1, the poster facts + drawing text, `05` §8 (helper). Instruction files: none changed.