felhom.eu/documentation/audits/r890-instructions-2026-10-06

2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the update ladder (R-890, R-891)

Rulings: 09 §3 decisions 149 (the admin seed on the test boxes) and 150 (instruction files kept true by the session).

Part B — vaultwarden 1.36.0-alpine → 1.37.4-alpine, both venues

venue	result	file
bench LXC 9401 (demo-hp), harness v5, FELHOM_BENCH_ADMIN_SEED=1, 600 s memory watch	proven: seed read back before and after, healthy in 30.9 s, anon peak 16.3 % (cgroup 22.3 %), 0 kills, 0 restarts, no file changed	bench/R890-vw.log, bench/evidence/MV-vaultwarden/verdict.json
scratch guest 9202 (drill catalog), FELHOM_BOX_ADMIN_SEED=1	proven: a fresh install; self-registration 400 (closed by design); the admin sign-in and invite INSIDE the box → (200, session yes, 200); invited registration 200; seed read back; the guarded Update backing-up → pulling → copying → verifying → done in 12.3 s; seed read back; badge „Frissítés elérhető — 80 napja" before, „Naprakész" after; removed through the product (no container, no volume left)	box/vaultwarden/step.txt, box/vaultwarden/box-verdict-vaultwarden.json, box/run.out

Written to the live catalog by upgrade-test.py --write-ladder (catalog ecb8552). The tool: tools/vwstep.py (one process, so the install and the seed are the same run — the guard requires that). 9202 pointed at the drill: box/C1-repoint-drill.txt.

Secrets: the admin token was never on DooPlex — the box read it from the container's environment and handed it to curl on stdin; only HTTP codes came back. Scan of bench/ and box/ for 48+ hex characters, VW_ADMIN= and ADMIN_TOKEN= values: 0 hits; control: a fresh 64-hex line → 1 hit. The bench's run .env is gone (shredded by the harness); the bench has 0 containers and is stopped.

Part C

• R-644: C/R-644-9202-live.txt — no gokapi on 9202 any more.
• R-763 / R-764 / R-762: C/wger.txt (tools/wgerwalk.py; wger un-hidden in the DRILL only, removed after).

Teardown

box/T1-repoint-live.txt (9202 back on the live catalog, byte-identical controller.yaml; the same six containers), box/T2-drill-reset.txt (drill = live).