Files

T

gates / gates (push) Successful in 20s

Details

CAMPAIGN 12 — the class sweep: golden 0.208.0 baked (awaiting vouch), R-256..R-263 filed, gating ranked

Part 1. Golden 0.208.0 baked on the drill VM, published and ROUND-TRIP VERIFIED — 656 150 362 B,
sha256 ba668f59..5ffb82, and ./etc/felhom-controller-image read OUT of the downloaded archive says
felhom-controller:0.208.0. Acceptance markers all green (overlay2 x1, mount points x2 rootfs+mp0,
upload HTTP 201 x1, excluding/FATAL/mp1 x0), Result=success. Token file->file, read inside the VM;
systemctl show grep = 0; committed-log grep = 0 WITH a control proving the grep works. Bake VM
destroyed, drill disk restored to virgin. NOT VOUCHED — the campaign halts there deliberately.

golden_currency_gate.py was correctly RED on arrival and is green after the bake. No --no-verify
was needed anywhere in this session.

Parts 2-4. Seven defect classes swept for siblings by class rather than by feature. Analysis only:
no product code, nothing deployed, no machine touched beyond the bake VM.

Eight new rows R-256..R-263 (ceiling moved from R-255), grouped by class in OPEN-ITEMS.md. C1
produced no new instance and has no row. The sharpest is R-260: the agent reports
operator_key_configured every heartbeat, the hub has no field for it, so the check that answers
"can the operator get into this box" returns ok for a box with no operator key installed.

Every class states whether its method re-found the known instances, because a method that cannot
re-find them has not been shown to work: C1 2/3 (verified by replaying the pre-fix templates),
C2 2/2, C3 2/3 + 1 as fixed, C4 fix-pattern re-found, C5 re-found, C6 deadcode 0/2 and bespoke 1/2,
C7 weakest and said so. Blind spots stated per class; seven suspicions investigated and DISPROVED,
including two of my own methods.

Part 4's ranking is in ROADMAP.md as G-1..G-8. Gate C5 (cross-repo tag reachability — cheap,
--fast-eligible, would have caught every R-260 instance on the introducing commit). Do NOT gate C6:
golang.org/x/tools/cmd/deadcode was measured against a PLANTED probe and is blind to unreachable
METHODS on widely-used types, which is exactly the shape both known instances have.

R-242's untouched half is recorded, not built: this bake demonstrated it, the currency gate flipping
green the moment the evidence DIRECTORY existed, before the round trip finished and with no vouch
near it.

Correction the campaign owed its own brief: escrow_stale was described as closed; it is R-247 and
READY. The live repo is the source.

Sampled rather than swept, exactly: C7 60 of 2652 production invariant comments and NONE of the 1440
test comments (that half is owed); C2 19 of 221 refusals; C3/C4 controller only. No finding was
reproduced live. STATUS.md is 100 lines against its 93-line one screen.

2026-08-07 23:07:42 +02:00

6.5 KiB

Raw Blame History

STATUS — what works, what's broken, what's next

Updated 2026-08-08 (overnight — Campaign 12).

A view, not a source. documentation/backlog/OPEN-ITEMS.md is the authority; this page restates part of it in plain words, and nothing may exist only here. Not CONTEXT.md, which is technical state written for Claude Code. Items, not paragraphs. One screen. If it does not fit, something belongs in the register instead.

Rebuilt from the register on 2026-08-07, from 258 lines. The old "what shipped recently" log is what the per-repo CHANGELOG.md files and the register are for, and is not restated here.

What works

A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer, who sets their own password. They install apps from a catalogue of fifty-three, share files over the home network, and open apps from a launcher or a shared link. Backups run on their own to three places — the machine's drive, a second drive, and an encrypted off-site copy.

The backup promise is proved, and so is getting the data back yourself. A machine has been destroyed on purpose and its files came back byte for byte identical — four times now, including a filename with Hungarian accents. On 2026-08-07 the household's own journey passed for the first time: someone with a browser and their recovery code got everything back with no command line inside the machine at any point. From logging in to seeing what is in the store took 72 seconds. (R-201 — closed.)

And the two rough edges that walk found are gone — after a rebuild the restore used to stop dead twice; both refusals now say what happened, that nothing is lost, and link to the screen that fixes it. (R-252, R-253 — closed 2026-08-08.)

What's broken

Nothing new is broken. All three secret-in-page faults are fixed; what remains is that the check against a fourth covers 4 pages of 27, and the cheap one covering all of them is blind to the shape that actually shipped. (R-255)
The machine's own screen keeps telling an already-paired box to pair itself — 25 minutes after it was paired, on a screen that promises it refreshes itself. (R-214, R-235)
A rebuilt machine cannot create a new recovery code at all. (R-221)
A backup that covered nothing still calls itself „Sikeres". The state is honest; the word is not. (R-240)
A machine waiting for its recovery code can stop backing up off-site without alarming us. After a rebuild we ARE told; the gap is a box reaching that state with no working tier behind it. (R-243)
The card offering to reopen set-aside backups promises more than we can deliver — we keep the old sealed package, but nothing can open it. (R-202)
Deleting a customer leaves rows behind on every test machine ever torn down, while reporting a clean teardown. No secrets involved, but it accumulates with each walk. (R-244)
Putting restored files back where they belong is still a manual step. (R-213)

Found overnight — we went looking for siblings, on purpose

Every fault this month came in one of seven shapes; overnight we looked for the others by shape — reading and counting only, nothing changed or deployed, no machine touched. Eight new items, none urgent. Full working: audits/CAMPAIGN-12-class-sweep-2026-08-08.md.

The one that matters. The machine tells us whether your engineer's emergency key is really installed — and we throw that sentence away before reading it, so a box can read as "we can get in" when nobody can. Same shape in seven other places. (R-260)
A green tick meaning only "a backup exists" — any age counts, and it reddens on a problem measured across all apps rather than that one. (R-258)
A disk we failed to measure is drawn as an empty, healthy one — "0.0 GB / 0.0 GB (0%)" in the normal colour, while the right pattern sits two files away. (R-259)
Two comments promise more than the code does (one guarded by a test that cannot fail on the thing it names), and two refusals still stop at "no", one in half-English. (R-262, R-263, R-256, R-257)
Which shapes can a machine catch from now on? That mattered more than the list: one is cheap and worth doing (the thrown-away-sentence one, which would have caught every instance on the day it was written), two need a small decision first, and two are honestly not automatable — including the one that looked most automatable, where the standard tool was tested and found blind. Recorded, not built. (ROADMAP G-1…G-8)

What we're working on

Widening the check so a fourth secret-in-a-page is caught by a machine, not by someone. (R-255)
Proving the hub really keeps the old sealed key when a machine re-seals — needs its own session and a second deliberate wipe. (R-198)

Waiting on you

One approval: the new base image. Tonight's release is baked, published and byte-checked, and installations still receive yesterday's version until you press Save. Hub → Configuration → Day-0 artifacts → Golden 0.208.0 → Save. One field moves; the other two are already right and were checked. Reversible — re-select 0.207.0 and Save. (R-242)
Third time in three days, so worth a minute. A check now catches the baking being forgotten; nothing catches the approval being forgotten — tonight's bake proved it, going green before the approval existed. Two ways to close it are written up, neither built. (ROADMAP G-8)

DooPlex infrastructure — separate from the product

Kept under its own heading rather than dropped: these are real asks that need you, but they concern the machine all this is built on, not what a customer receives. Mixing them in is why the page stopped being readable.

DooPlex's own backup keeps every copy inside the same box, and is silent when it fails. (R-232)
193 old images exist only on this machine, ~27 GB against 199 GB free — clutter, not space. (R-210)
The hub password needs rotating — a diagnostic printed it into a session log; nothing suggests anyone else saw it. (R-132)
One thing to read after DooPlex next restarts — the second-SSD move has never survived a reboot; it writes PASS/FAIL to /var/log/felhom-store-postboot-check.log. On PASS, 34 GB comes back. (R-209a)
Backup scripts on DooPlex are unversioned host state (R-231), and the instruction-file follow-ups each need a decision rather than an edit (R-229, R-230).

6.5 KiB Raw Blame History