admin 5277d859d5 hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189) ...

The Cloudflare tunnel token, Cloudflare API token and git token inside customer_configs.config_json now hold the
05 §16.2 seal (enc:v1:, OFFSITE_SECRET_KEY). Old rows sealed once at start-up without a config_version bump, then
VACUUM + WAL checkpoint (an UPDATE leaves the old plaintext in a freed block). -unseal-box-secrets opens them too.
Eight tests, each red-proved. Built, not deployed. Audit: documentation/audits/hub-token-seal-2026-10-23/.

2026-10-23 19:48:17 +02:00

..

capability-map-detail

D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC)

2026-10-23 13:35:38 +02:00

_design-review.md

fix: update repo-name refs after deploy-felhom-compose -> felhom-controller rename

2026-06-08 14:03:13 +02:00

_hub-review.md

moved documentation to felhom.eu

2026-06-08 13:50:14 +02:00

_recovery-inventory-2026-07-28.md

hub v0.88.0 — the WAL that never was (R-172)

2026-08-02 21:06:29 +02:00

00-capability-map.md

D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC)

2026-10-23 13:35:38 +02:00

01-topology-and-trust.md

webpage: the four git-syncs read Gitea in-cluster; sidecars retry forever (--max-failures=-1); gate 6 keeps the --repo values identical

2026-10-19 11:38:44 +02:00

02-controller-module-map.md

Day 2026-10-19: agent 0.160.0 (released, not vouched), controller 0.332.0 floor (one sign-in R-1100, escrow confirm R-1151), hub 0.159.0 deployed (R-1150, R-1154), R-1153 not a defect, old-restic check passed; register 168 -> 166 (closed 10, opened R-1155..R-1162)

2026-10-19 05:38:38 +02:00

03-host-agent.md

night 2026-10-23 so far: D30 live proof (re-key → new-key handshake; ep0-started handshakes heal a short clock jump by themselves), D4 patches v2 after review, test-night install/fixture evidence, DooPlex survival survey (read only) + PLAN, 03/05/07 + CONTEXT, total-loss runbook: MAIL-HOLD shipped

2026-10-22 22:24:48 +02:00

04-control-plane-authorization.md

burndown 3: report, evidence, register (174 -> 168), 07 Redis RDB [DESIGN], 04 §6.3 the box's password doors

2026-10-17 10:28:03 +02:00

05-hub-architecture.md

hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189)

2026-10-23 19:48:17 +02:00

06-offsite-connectivity.md

architecture: the system poster committed, its facts given a home, and a rule to keep them together

2026-10-09 18:09:50 +02:00

07-backup-architecture.md

night 2026-10-23 so far: D30 live proof (re-key → new-key handshake; ep0-started handshakes heal a short clock jump by themselves), D4 patches v2 after review, test-night install/fixture evidence, DooPlex survival survey (read only) + PLAN, 03/05/07 + CONTEXT, total-loss runbook: MAIL-HOLD shipped

2026-10-22 22:24:48 +02:00

08-alarm-ladder.md

hub 0.165.0 source: a household's mail list is never overwritten by a box default, a box reads it back (R-1199 reopened); host_swap_short only when swap is really short (R-1216, D28 = A); host-swap-rule gate with 4 decoys; 03/05/08 updated

2026-10-22 12:23:07 +02:00

09-update-architecture.md

D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC)

2026-10-23 13:35:38 +02:00

10-localisation.md

register: R-1211 (the household backup_failed mail names no app and no next step), R-1212 (two backup texts ignore the box language), R-1213 (operator detail left on two pages) — the night helper's findings; 10-localisation: W25 narrows the verbatim rule on the off-site page; 180 -> 183

2026-10-22 00:07:57 +02:00

11-os-updates.md

Night 2026-10-19: register 161 -> 161 (closed R-921, R-953, R-986; opened R-1168..R-1170; R-1001/R-1011/R-1010/R-1070/R-1167 READY, R-893 READY with the measured design note -> D20, R-1083 gap); morning list in STATUS; 03/05/07/11 updated; R-893 evidence

2026-10-19 21:44:10 +02:00

12-agent-tooling.md

CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

2026-10-17 13:33:07 +02:00

13-threat-model.md

Plex2Shell impact on Felhom: verdict NOT REACHED; R-1241 (P1), R-1242 (P3) opened (register 186 -> 188)

2026-10-23 17:53:43 +02:00

14-host-power-off.md

Power-cut fixes: spike C1–C4 + Immich repair spike (F); docs 03/07/13/14; R-1003 + R-1000 closed (FAQ live), R-1006..R-1009 narrowed, R-1010 filed; estimator raise STOPPED (one verdict flips); uninstall knows the new helper

2026-10-14 11:55:19 +02:00

15-media-library.md

Controller v0.314.0 released under decision 250: floor 0.314.0 raised by CC's token at 13:11 UTC after the three test boxes

2026-10-15 15:21:28 +02:00

16-storage-physical-identity.md

storage identity build B: live proof, R-1068/R-1079/R-1082/R-1084 closed, R-1093/R-1094 opened, D15, golden 0.318.0 record, backup page

2026-10-16 10:07:13 +02:00

felhom-system-poster.facts.md

Day 2026-10-23 close-out: rulings D31-D36 in CONTEXT; STATUS (releases done, do list, D35 dated, D37/D38); register 191 -> 184 (closed R-49 R-982 R-985 R-991 R-1204 R-1205 R-1225 R-1226 R-1227 R-1230 R-1234; opened R-1235 R-1236 R-1237); the break-glass sheet current (D32, one A4, HU+EN); runbooks for D33/D34; poster facts; evidence day-2026-10-23

2026-10-23 11:03:45 +02:00

felhom-system-poster.html

Day 2026-10-23 close-out: rulings D31-D36 in CONTEXT; STATUS (releases done, do list, D35 dated, D37/D38); register 191 -> 184 (closed R-49 R-982 R-985 R-991 R-1204 R-1205 R-1225 R-1226 R-1227 R-1230 R-1234; opened R-1235 R-1236 R-1237); the break-glass sheet current (D32, one A4, HU+EN); runbooks for D33/D34; poster facts; evidence day-2026-10-23

2026-10-23 11:03:45 +02:00

felhom-system-poster.pdf

system poster refreshed 2026-10-21: one-file HTML + A1 PDF from Claude Design (data area, https only); R-1201 closed

2026-10-21 13:25:43 +02:00

where-felhom-stands-2026-08-09-snapshot.html

Verify the standing picture against source: 12 downgrades, and the decay ran both ways

2026-08-09 18:40:49 +02:00

where-felhom-stands.html

answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

2026-10-12 14:07:50 +02:00

where-felhom-stands.yaml

answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

2026-10-12 14:07:50 +02:00