admin
27f4e7d976
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
63 lines
3.7 KiB
Markdown
63 lines
3.7 KiB
Markdown
# STATUS — what works, what's broken, what's next
|
|
|
|
**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
|
|
|
|
**Updated 2026-10-01 (late night). Both demo boxes run controller 0.286.1 and host agent 0.138.0. Hub 0.126.0. New
|
|
installs get golden 0.286.1 with agent 0.138.0.**
|
|
|
|
**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
|
|
|
|
## Tonight: the box tells visitors apart
|
|
|
|
- **Before:** through the internet every visitor looked like the same address. A stranger's 5 wrong passwords locked the
|
|
whole family out of the box's own dashboard for a minute, and out of some apps.
|
|
- **Now:** the box sees each visitor's real address, and a stranger cannot fake it. Measured on demo-hp through the real
|
|
internet path: a stranger's wrong passwords locked only that stranger.
|
|
- **Apps:** 19 apps would have believed a faked address. They are protected, in the same update. BookStack now locks
|
|
only the stranger, measured. Home Assistant no longer treats every internet visitor as "at home".
|
|
- **Not measured:** a second outside address on the real internet path. The test machine abroad was refused by
|
|
Cloudflare before it reached the box. A 2-minute test from your phone would close it.
|
|
|
|
## The permanent family gate: tested, NOT built
|
|
|
|
- A gate with a login for each family member, in front of Grimmory and MeTube, passed every test on the scratch box.
|
|
- **Strangers:** they reached nothing, and their wrong guesses locked only themselves.
|
|
- **Family:** members stayed signed in for 30 days, logout worked, and the family login does not open the dashboard.
|
|
- **E-readers:** Kobo, KOReader and OPDS readers kept working with Grimmory's own login.
|
|
- **Cost:** under 1 ms per page. If the box's controller is down, the gated apps refuse — they never open.
|
|
|
|
## Also tonight
|
|
|
|
- **SparkyFitness passed most of the checklist.** One problem: its **licence forbids commercial use** without the
|
|
author's written permission (below).
|
|
- **Two box fixes:**
|
|
- The health check now says "not checked" instead of "healthy" when it could not look.
|
|
- A removed and restored app keeps its sign-up lock.
|
|
- **A new golden.** Fresh installs get today's version.
|
|
|
|
**Rows.** 4 closed, 12 opened. The list went from 410 to 422 rows.
|
|
|
|
## What needs you
|
|
|
|
1. **The permanent family gate: build it or not?**
|
|
- **Go:** 2 work sessions — the box first, then Grimmory and MeTube published behind it.
|
|
- **No-go:** Grimmory stays unpublished, and MeTube is not built.
|
|
- **If you say nothing:** nothing is built, and the next sessions do other work.
|
|
- I would choose **go**. It also answers Grimmory and MeTube.
|
|
2. **SparkyFitness's licence** says "non-commercial use only".
|
|
- **A:** hide it from new installs and ask the author for permission.
|
|
- **B:** keep it offered while asking.
|
|
- I would choose **A**.
|
|
- **If you say nothing:** it stays offered.
|
|
3. **Grimmory:** publish behind the family gate (if go), or as it is now. Its lock is per visitor since tonight; read in
|
|
its code, not yet measured.
|
|
4. **One phone test (2 minutes):** sign in to demo-hp's dashboard from your phone off wifi, while I lock out my own
|
|
address. If you skip it, the second-address proof stays the simulated one.
|
|
5. Still open from before: Invidious and moonlight-web — I advise no to both. MeTube and Pinchflat are stopped.
|
|
|
|
## Standing steps
|
|
|
|
- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
|
|
- **Weekly:** the golden bake (around 8 October; tonight's bake was 0.286.1).
|
|
- **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.
|