REPORT — second day brief, 2026-10-19 (ep0 one copy per week; the passphrase measured; hub 0.160.0; controller 0.333.0; gofmt gates)

In plain words

ep0 keeps one whole-box copy per week, for 2 weeks (your „yes"). Before the change, PBS's own dry run showed it removes nothing today. The first real run is 2026-10-20 03:30 UTC; CC reads it then (row R-1162 stays open until then).
The household passphrase: alone it gets the box's keys, and with them every off-site key action. Two options are in STATUS (D19). CC picks A: the passphrase gives keys only while the customer has no box record.
Controller 0.333.0 is the floor for every box (12:16 local): a dashboard sign-out now also ends the file manager's own 2-hour pass; the recovery-code page says the code becomes live after the two words.
Hub 0.160.0 is live (your „yes"): a reinstall within 45 minutes mails you too; a repeated refused backup is counted and the alarm repeats at most once a day; the old off-site re-issue on a reinstall is kept, with true words.
gofmt: the hub and the agent are formatted, and both now have the controller's gate.
New for you: another device keeps taking demo-hp's network address (R-1166) — fix it in the router.

1. ep0 (R-1162; `07` Plane-2 row and §6.1)

Before (audits/day-2026-10-19b/P1/ep0-settings-before.txt): prune-demo-hp and prune-demo-felhom — keep-last 2, 03:30, ns-scoped, max-depth 0; prune-operator-hubdb — keep-daily 14 + keep-weekly 8, 03:45. tester-1 (3 copies) and Tester-2 (1) have no job. ep0's clock is UTC.
DooPlex's copy of ep0: prune-ep0-copy, keep-weekly 8, 07:30 (decision 71) — already by time; not changed.

Dry run (PBS's own: proxmox-backup-debug api create /admin/datastore/felhom-offsite/prune --dry-run true …, no task created; cross-checked with an offline model of PBS's selection, P1/prune_sim.py; 8 snapshots before and after):

Box	Snapshots	keep-last 2 removes	keep-weekly 2 keeps	keep-weekly 2 removes
demo-hp	2	none	2026-10-08, 2026-10-15	none
demo-felhom	2	none	2026-10-06, 2026-10-13	none
tester-1 (no job)	3	(2026-10-04)	2026-10-11, 2026-10-18	(2026-10-04)
Tester-2 (no job)	1	none	2026-10-04	none

Answer: „Yes, the two rules" (not the tester-1 job). After (07:49 UTC, P1/ep0-settings-after.txt): both jobs keep-weekly 2, schedule 03:30 unchanged, nothing run by hand. Check for 2026-10-20: the 03:30 prunejob tasks OK with keep-weekly 2 and two snapshots per namespace (the next step of R-1162).

2. The household passphrase (R-1159)

Measured with the hub's real router (P2/passphrase-reach.txt; a made-up customer, a fake off-site service). A live measurement on Tester4 was not possible: CC holds no Tester4 passphrase, and reading it from the hub database was refused by CC's own safety check (correctly).

Passphrase → GET /config/{id} 200 with hub.api_key (wrong passphrase 401); POST /host-enroll 200 with the EXISTING host's key.
Controller key → register-key, confirm-key (removes every other line, the box's own key included), move-aside, window-open, abandon-request (the hub deletes a set-aside copy after 7 days unless cancelled), abandon-cancel, abandon-status: all past auth (wrong key 401 each).
Host key → escrow GET/PUT, recovery-credential PUT, wg, desired-state, jobs, host-report: all past auth.
The passphrase is used only at install time (the installer, the controller's setup wizard).
Option A (CC's pick): keys only while the customer has no host record (/config leaves out the key, /host-enroll refuses once a host exists). Closes the chain at its source; a reinstall needs the operator's delete first — already the rule since R-1154. Option B: a second factor on the destructive off-site routes. Every reinstall waits for the operator, and the host key stays reachable by the passphrase, so B alone does not close it. No change in this task.

3. Controller 0.333.0 — R-1155, R-1161, the Install chip

R-1155: first measured on demo-hp (0.332.0): the household's FileBrowser token opened FileBrowser after the dashboard sign-out (200, cookie and Bearer). Fix: the forwardAuth answer refuses a request with no valid files cookie that carries a non-admin FileBrowser token, everywhere FileBrowser reads one (cookie, ?auth=, Bearer, Basic password). The commit's security review found Basic missing in the first version (c809dd3); fixed in a6fa3c0 before any release. Red-proofs: without the check → 200 after the sign-out; without the Basic branch → 200; with every token refused → admin's own token 302. Live (rc.2 demo-hp, 0.333.0 Tester 1): files cookie 200; token alone 401 in all four forms, before and after the sign-out; FileBrowser's sign-in page 200.
R-1161: new key backups_escrow.ez_a_kod_az_ellenorzes (hu + en); the old sentence only when the claim answer says no confirm. Fixtures re-captured: escrow_first, escrow_receremony (reason: R-1151 made the old sentence untrue); all others byte-identical. Live on demo-hp (P6/06-escrow-page-text.txt): new text shown, old hidden, switch present, negative control 0.
The Chrome „Install" chip: NOT-A-FINDING. FileBrowser 1.5.6 links /public/static/site.webmanifest on every page; its only PWA setting is disablePWAInstall (already set). Not patched (P3/install-chip.txt).

4. Hub 0.160.0

R-1156: a live re-enroll is a warning mailed to the operator, same instruction; a --resume mails too and says it needs nothing. R-1157: further refusals in one episode counted (refusals_in_episode), alarm at most once a day, total on the cleared record. R-1158: the reinstall's off-site re-issue changes nothing a box uses (only the hub's own registrar reads that password; no box has received it since v0.127.0); kept because it repairs a broken stored login; comments and the offsite_reissued text corrected (05 §8). Each red-proved.
Answer: „Yes, deploy now". Image 0.160.0 digest sha256:e9a360bc00d00a15014e272c4d023fef118a8b043956f3fc928dd26c00b34230 (clean clone at a17db0c3; the first push hit a DNS timeout, the retry pushed it). Manifest 5d3cb5c1; only Deployment/hub was OutOfSync and only it was synced; Synced/Healthy; running image digest = built digest; 0 [ERROR] lines; floor read back from hub.db + WAL (0.332.0 then, 0.333.0 now); host and controller reports from demo-hp, Tester 1 and demo-felhom after the restart.

5. gofmt (R-1160)

Hub d5e3c8b0 (22 files) and agent 1edfd8e (14 files), formatting only, tests green before each. Gates: hub-gofmt (scripts/hub_gofmt_gate.py, repo_gates.py) and gofmt (felhom-agent scripts/gofmt_gate.py, agent_gates.py), fast set, decoys on scratch trees, red-proved. No agent release.

6. Controller release (decision 250)

Per-box floors 0.333.0 at 09:59:38 UTC → all three on 0.333.0 within about a minute (demo-hp from rc.2 at 10:13). Box walk (P6/): 0 unhealthy, 0 allow-list refusals, catalog in sync; https-only 28 OK, 0 failures; „Fájlok ↗" with no second login on demo-hp and Tester 1, sign-out asks again. Global floor 0.333.0 / MinAgent 0.158.1 at 10:16:22 UTC (303 floor_set, read back with the WAL); per-box floors cleared.

7. Versions, commits, fixtures, rows

Controller 0.333.0 (c809dd3, a6fa3c0, REPORT e1a2abf), image digest sha256:f150a8d8cd329f5cde9e34249e34edc59b6b5db29db1e3200900f3869a0de11b; rc.1/rc.2 on demo-hp only. Fixtures: escrow_first, escrow_receremony.
Hub 0.160.0 (d5e3c8b0, 503c93fa, a17db0c3, manifest 5d3cb5c1).
Agent: no release (1edfd8e, 0cbd500). 0.160.0 stays the vouched one.
Rows: 167 before, 163 after; closed 6 (R-1155, R-1156, R-1157, R-1158, R-1160, R-1161), opened 2 (R-1165, R-1166); R-1159 → READY (D19), R-1162 → NARROWED (one run to read).
System poster: text only — felhom-system-poster.facts.md and the matching text in felhom-system-poster.html („last 2" → „one per week, 2 weeks").
Teardown: machine — rc images only on demo-hp 9201, now on the release; no test app. Host — none. Hub — no test customer; the per-box floors cleared. ep0 — the two prune jobs changed on the operator's yes, nothing else.

Observations

Two household namespaces on ep0 have no prune job; nothing creates one for a new household. FILED: R-1165.
Another device takes demo-hp's address 192.168.0.104 every few minutes; demo-hp also lost its link to ep0 for 8 minutes. FILED: R-1166.
A config download with the passphrase is a log line only, and the host key it yields can rewrite the box's escrow and recovery credential. FILED: R-1159.
The first R-1155 version missed FileBrowser's Basic-auth token source (the commit's security review). NOT-A-FINDING: fixed before any release in a6fa3c0 and red-proved (the size rule).
Chrome offers „Install" for the file manager. NOT-A-FINDING: FileBrowser 1.5.6 has no setting that stops its manifest; the brief forbids patching it.
One of CC's probe scripts on DooPlex passed the household's FileBrowser token to curl on its command line (visible to local processes for about a second; never printed or saved). NOT-A-FINDING: CC's own tooling on DooPlex, not the product; every probe now passes tokens through 0600 header files, and the token expired two hours later.
Two copies of CC's hub-database snapshot ran into one folder at once and one read failed („malformed"). NOT-A-FINDING: CC's helper, a local copy only; the live hub and its database were untouched, and the next read was clean.
The first hub image push failed on a DNS timeout at DooPlex. NOT-A-FINDING: a short DNS outage (the website session saw it too); the build's own check found the tag absent and the retry pushed it.
FileBrowser's admin password login was not walked live. NOT-A-FINDING: CC holds no FileBrowser admin password; admin's token passing is unit-pinned and the sign-in page answers 200 live.

10 KiB Raw Blame History