admin 09b5f02fc3 hub(R-1218): never replace a recovery package that seals the off-site key with one that seals none (409) ...

SaveHostEscrowWithIdentity refuses (ErrEscrowWouldDropRepoKey); the PUT answers 409. Red-proved (store: superseded=true;
API: 500). Two older tests pinned the old demotion and are updated. Commit only.

2026-10-26 20:21:08 +01:00

..

accesslog

Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass

2026-10-17 23:31:34 +02:00

api

hub(R-1218): never replace a recovery package that seals the off-site key with one that seals none (409)

2026-10-26 20:21:08 +01:00

assets

feat(hub): Configuration page, asset seedOrUpdate, English UI

2026-02-25 09:34:43 +01:00

claim

hub v0.159.0 (R-1154, after security review): the enroll reuse path re-issues nothing, it warns the operator

2026-10-19 03:29:44 +02:00

cloudflare

hub R-138: the token's one zone must BE the customer's domain (order-independent; security review)

2026-10-08 15:17:05 +02:00

configgen

hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189)

2026-10-23 19:48:17 +02:00

dbsnap

hub 0.167.0 + DooPlex push: the hub DB snapshot every 6 hours (D34, operator yes 2026-10-23, R-232 G5) — slots 02/08/14/20, catch-up 6 h, push :30 after each, refuse a copy older than 2 h; tests red-proved

2026-10-23 09:12:08 +02:00

gitea

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

hetznerapi

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

i18n

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

intent

hub: box presence from the wait channel + delete a switched-off box at once (R-30, D2)

2026-10-08 15:17:05 +02:00

mailhold

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

mailrelay

hub v0.18.0: app-email passthrough POST /api/v1/mail → Resend SMTP

2026-06-29 08:45:22 +02:00

monitor

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

notify

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

offsite

hub v0.160.0: a live re-enroll mails the operator (R-1156); further refused backups counted, alarm once a day (R-1157); the reinstall's off-site re-issue says what it still does (R-1158)

2026-10-19 10:34:41 +02:00

offsiteheal

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

offsitekeys

hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

2026-10-21 13:36:45 +02:00

osupdates

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

pbsdrheal

hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

2026-07-21 10:01:35 +02:00

poke

hub v0.59.0: Direction-2a agent-plane immediate-sync poke sender + ep0 felhom-poke surface

2026-07-16 22:48:15 +02:00

semver

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

store

hub(R-1218): never replace a recovery package that seals the off-site key with one that seals none (409)

2026-10-26 20:21:08 +01:00

sysfacts

Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193

2026-10-24 09:18:44 +02:00

tenantsync

R-1295: the PBS DR set-up waits out PBS's 5-s permission cache. Cause measured on a throwaway PBS 4.2.5 under load (v1.3.0 failed 11/30, v1.4.0 0/30): tenantsync v1.4.0 re-checks the same token (and the admin token) up to 15 s; hub v0.172.0 retries a self_check_failed rollback 3x, 7 s apart, and a final failure mails the operator (pbsdr_provision_failed, operator-only). Red-proved. Commit only; ep0 unchanged.

2026-10-26 12:27:28 +01:00

web

hub(D53): held apps reach the operator — mirror, Held apps list (host + Hosts page), reminder after the grace

2026-10-26 18:25:00 +01:00

wgsync

hub: wgsync fix — constrain HostKeyAlgorithms to the pinned key's type

2026-07-03 23:52:08 +02:00