admin 722013da90 R-1295: the PBS DR set-up waits out PBS's 5-s permission cache. Cause measured on a throwaway PBS 4.2.5 under load (v1.3.0 failed 11/30, v1.4.0 0/30): tenantsync v1.4.0 re-checks the same token (and the admin token) up to 15 s; hub v0.172.0 retries a self_check_failed rollback 3x, 7 s apart, and a final failure mails the operator (pbsdr_provision_failed, operator-only). Red-proved. Commit only; ep0 unchanged.

2026-10-26 12:27:28 +01:00

..

static

D4 Part 1: hub fonts + sprite + statusColor semantic remap

2026-07-02 22:34:40 +02:00

templates

Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193

2026-10-24 09:18:44 +02:00

agent_only_vouch_test.go

Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass

2026-10-17 23:31:34 +02:00

appliances_test.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

appliances.go

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

2026-07-17 23:56:53 +02:00

apps_render_test.go

hub v0.43.0: remote app-log diagnostics — copyable issues + context + on-demand log tails + range/dismissal fixes

2026-07-10 16:03:32 +02:00

apps.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

artifact_choices_test.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

artifact_installability_test.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

artifacts_form_render_test.go

hub v0.68.1 — fix the Configuration layout broken by the wrapper-sha field

2026-07-21 10:34:34 +02:00

backup_card.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

bind_language_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

change_password_test.go

@

2026-07-13 22:46:49 +02:00

claim_ui_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

configs_debug_test.go

R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129

2026-10-08 10:19:39 +02:00

configs_delivery_render_test.go

hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

2026-07-23 12:59:04 +02:00

configs_offsite_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

configs.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

controller.yaml.default

hub v0.50.0: customer-claim arc docs (CHANGELOG, default template claim_code_* fields, REUSE rows)

2026-07-12 18:45:43 +02:00

customer_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_delete.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

customer_edit_tab_test.go

R-32 (decision 167): RESET purges the off-site folder through the sub-account's own login before deleting it

2026-10-07 10:21:25 +02:00

customer_ghost_delete_render_test.go

hub v0.70.1: the ghost customer's Delete button must exist (Danger-zone render gate split)

2026-07-22 09:23:37 +02:00

customer_reset_render_test.go

hub v0.61.0 + felhom-tenantsync v1.1.0: Customer RESET (middle lifecycle tier)

2026-07-17 13:09:04 +02:00

customer_reset_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

customer_reset.go

feat(hub): v0.70.0 — a deleted customer actually disappears (residue leg + ghost cleanup)

2026-07-21 20:28:06 +02:00

customer_state_banners_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

customer_tabs_test.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

declared_floor_test.go

hub v0.112.0: a floor carries a declared MinAgent past the golden (R-472)

2026-09-13 16:47:11 +02:00

deliberate_off_view_test.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

dr_recipe.go

hub v0.13.0: DR recipe — assemble + store + view the secret-free reconstruction recipe

2026-06-16 18:49:45 +02:00

drtier_test.go

hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

2026-07-12 20:37:00 +02:00

embed.go

D4 Part 1: hub fonts + sprite + statusColor semantic remap

2026-07-02 22:34:40 +02:00

escrow_demote_wording_test.go

hub v0.60.1: host deletion demotes escrow custody (never destroys) + customer-delete purge point + S6b obsolete

2026-07-17 11:25:38 +02:00

floor_ui_test.go

hub v0.171.0 (unreleased): a set-aside-only backup digest mails as a warning that says nothing failed (R-1287); a test build is never the fleet's newest (R-1289). Red-proved. Commit only.

2026-10-25 21:21:18 +01:00

funcmap_test.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

hosts_delete_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

hosts_guestnet_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

hosts_identity_test.go

hub v0.154.0: the host page shows each storage place's physical disk(s) and whether the agent proved them (16 §3)

2026-10-15 21:28:05 +02:00

hosts_network_test.go

hub v0.85.0 — Network card: a host's addresses are visible at last

2026-07-31 08:49:44 +02:00

hosts_recovery_reveal_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

hosts_test.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

hosts.go

hub v0.154.0: the host page shows each storage place's physical disk(s) and whether the agent proved them (16 §3)

2026-10-15 21:28:05 +02:00

logbundle.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

logtail.go

feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

2026-07-16 20:44:22 +02:00

mailhold_test.go

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

offsite_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

offsite_box.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

offsite_default_test.go

hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

2026-09-16 16:56:01 +02:00

offsite_integrity_line_test.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

offsite_test.go

hub: offsite multi-endpoint management UI (v0.47.0 part 5)

2026-07-11 21:35:24 +02:00

offsite.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

opactions_test.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

opactions.go

hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

2026-10-08 15:17:06 +02:00

os_updates.go

hub v0.143.0 (code): the kernel lane — the day-before household mail, the night instruction, the operator's kernel set (R-836, decision 172)

2026-10-07 15:34:14 +02:00

passphrase_handover_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

pbsdr_box_render_test.go

hub v0.65.0 — PBS DR storage visibility (ep0 usage op) + Offsite tab split + dual dashboard gauges (R-5)

2026-07-17 21:13:30 +02:00

pbsdr_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

pbsdr_generation_test.go

hub: R-39 core — stamp a secret GENERATION into the pbs_dr descriptor

2026-07-21 09:52:04 +02:00

pbsdr_poke_test.go

hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

2026-07-17 17:30:41 +02:00

pbsdr_test.go

hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

2026-10-22 21:04:42 +02:00

pbsdr.go

R-1295: the PBS DR set-up waits out PBS's 5-s permission cache. Cause measured on a throwaway PBS 4.2.5 under load (v1.3.0 failed 11/30, v1.4.0 0/30): tenantsync v1.4.0 re-checks the same token (and the admin token) up to 15 s; hub v0.172.0 retries a self_check_failed rollback 3x, 7 s apart, and a final failure mails the operator (pbsdr_provision_failed, operator-only). Red-proved. Commit only; ep0 unchanged.

2026-10-26 12:27:28 +01:00

r30_presence_delete_test.go

hub: box presence from the wait channel + delete a switched-off box at once (R-30, D2)

2026-10-08 15:17:05 +02:00

r133_reveal_wrongkey_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r135_csrf_test.go

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

2026-10-15 12:20:35 +02:00

r136_host_cookie_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

r138_cf_token_reach_test.go

hub R-138: the token's one zone must BE the customer's domain (order-independent; security review)

2026-10-08 15:17:05 +02:00

r276_host_delete_wg_test.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

r277_r92_bytes_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r283_box_claim_test.go

R-283: customer page shows the box's own claim state beside the hub's, and warns on a mismatch

2026-10-05 21:45:04 +02:00

r292_artifact_flash_test.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

r331_backup_card_test.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

r349_agent_binary_test.go

R-349 (hub half): host page shows agent-binary drift from the reported agent_sha256

2026-10-05 21:45:04 +02:00

r415_domain_conflict_test.go

R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129

2026-10-08 10:19:39 +02:00

r508_no_email_banner_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r544_r599_host_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r604_floor_held_back_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r725_bind_expired_copy_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r728_create_once_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r975_form_tokens_test.go

hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189)

2026-10-23 19:48:17 +02:00

r1295_pbsdr_selfcheck_test.go

R-1295: the PBS DR set-up waits out PBS's 5-s permission cache. Cause measured on a throwaway PBS 4.2.5 under load (v1.3.0 failed 11/30, v1.4.0 0/30): tenantsync v1.4.0 re-checks the same token (and the admin token) up to 15 s; hub v0.172.0 retries a self_check_failed rollback 3x, 7 s apart, and a final failure mails the operator (pbsdr_provision_failed, operator-only). Red-proved. Commit only; ep0 unchanged.

2026-10-26 12:27:28 +01:00

refresh_cachebust_test.go

hub: scoped auto-refresh + style.css cache-bust + staging rule (v0.48.0 parts 3-4)

2026-07-12 17:37:04 +02:00

render_test.go

hub: delete the host-install version label (R-94) + invert hostinstall gate 1

2026-08-02 15:16:01 +02:00

rollup_test.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

rollup.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

routes.go

hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed

2026-10-15 13:33:25 +02:00

selfbind_automint_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

selfbind_mint.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind_naming_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_resend_test.go

hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

2026-10-21 13:36:45 +02:00

selfbind_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_waiting_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind_words_test.go

hub 0.164.0 (unreleased): bind mail true when no box exists (W3), tries left on a wrong try (W4), use the newer mail hint (W5)

2026-10-21 22:18:38 +02:00

selfbind.go

hub 0.164.0 (unreleased): bind mail true when no box exists (W3), tries left on a wrong try (W4), use the newer mail hint (W5)

2026-10-21 22:18:38 +02:00

server.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

spoiled_floor_test.go

hub v0.155.0: the floor can never deliver a withdrawn controller build (R-1085); RomM/Ghost evidence

2026-10-16 12:24:39 +02:00

system_bundle_test.go

hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

2026-10-04 20:18:37 +02:00

system_layout_test.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system_line_test.go

Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193

2026-10-24 09:18:44 +02:00

system_test.go

hub v0.162.0 (built, not deployed): no repeat mail after a restart for a known-down host or an already-reported stale restore test (R-1001); the Day-0 agent list leaves out packages without the felhom-agent file, a vouch of one is refused (R-1011); an absent tunnel reads 'none set up' (R-1070)

2026-10-19 20:27:01 +02:00

system_trim_test.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system_view.go

hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

2026-10-10 15:38:25 +02:00

system.go

Attended release run: hub 0.168.0 deployed (R-975 closed; the live file's residue accepted by the operator, 05 16.2); D40 in effect (R-1243 VERIFY, dated check 10-25); D41/D42 closed; the ep0 iperf3 line-test server (scripts/ep0-iperf3, 06 5) and hub 0.169.0 models line_test (System page cell); R-1249, R-1250 filed; register 194 -> 193

2026-10-24 09:18:44 +02:00

templatefetcher.go

fix: update repo-name refs after deploy-felhom-compose -> felhom-controller rename

2026-06-08 14:03:13 +02:00

tokens_test.go

hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed

2026-10-15 13:33:25 +02:00

tokens.go

hub: gofmt -w on 22 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:26:36 +02:00

version.go

feat: add controller update trigger + version checker (v0.1.8)

2026-02-19 18:16:38 +01:00

wrapper_drift_test.go

hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

2026-07-21 10:01:35 +02:00