felhom.eu/REPORT-family-gate-2026-10-02.md

REPORT — the family gate built; Grimmory and MeTube published; every app's licence read (2026-10-02)

Brief: "the family gate, built (controller + catalog), Grimmory and MeTube published behind it; every app's licence read; SparkyFitness's licence ruling recorded; one controller release and a golden bake". Architecture read: 01-topology-and-trust.md §5 (the family-gate paragraph is new), 09 §3 decisions 46, 47, 63, 64, 65. Evidence root: documentation/audits/family-gate-2026-10-02/.

Part	State	One line
A — the controller	DONE	v0.287.0: family members with own logins, a door per family app, anchored exceptions, the Család card. Exit items 1–5 live on 9202.
B — the catalog	DONE	Format + gate family-gate; Grimmory (4 e-reader exceptions) and MeTube (none) published (catalog 96829d0) with complete records; on 9202 and demo-hp through the product.
C — licences	DONE	58 templates, every image, one table (audits/licences-2026-10-02/TABLE.md); short list in STATUS; nothing hidden or changed.
D — SparkyFitness	DONE (not sent)	Request drafted (audits/licences-2026-10-02/EMAIL-DRAFT-sparkyfitness.md); decision 65 + trigger in STATUS.
E — release	DONE	Floor 0.287.0 (min_agent 0.131.0), both demo boxes in ~25 s; golden 0.287.0 baked, round-tripped, vouched; currency gate OK. Phone test SKIPPED (operator not present).

Not stopped between sessions: Part A was proven live on 9202 before Part B started (A/items.txt).

Claims in the brief, checked

• "The family session is separable with the existing cookie scheme" — right, with one addition: a separate cookie name (felhom_family) scoped to Path=/__family and a separate store; RequireAuth never reads it (test TestFamilyGate_MemberPassesButNeverTheDashboard, red-proof RP-F1; live: the member's cookies at /launcher → the dashboard login, also through the real internet).
• "Grimmory's e-reader paths keep their own auth behind an exception" — right, measured per path as a stranger through the simulated tunnel: OPDS 401 (Grimmory's), Kobo made-up token 401, KOReader wrong key 401, Komga API 401; the right credentials 200; look-alikes (/api/v1/opdsx, /api/koreaderx, ../) → the gate.
• "MeTube's websocket passes forwardAuth" — right: a member's upgrade → 101; a stranger's websocket and polling → 401.
• "Whether n8n's licence limits paid services" — partly: own internal or personal use is allowed; providing it to others is allowed only free of charge for non-commercial purposes. Pulling the unchanged image onto the household's box is arguably not that — a grey zone, now an operator row (R-791).

Proof

• Controller: suites green; red-proofs RP-F1..F7 (A/RP-F-family-gate-mutants.txt). Live (A/items.txt): a stranger 0 app answers of 36; members in; reset/remove/logout end access at the next request; a stranger's 7 guesses lock only the stranger; controller down → 500, never the app; the gate costs 0.49 ms. Through the real internet on demo-hp (B4/member-internet.txt): a member's browser → the family sign-in → MeTube; logout → refused; a stranger 401.
• Catalog: catalog_gates.py grimmory and metube exit 0 on the bench, every gate OK (B/catalog-gates-*.txt). Decoys of the new gate seen red (B/family-gate-decoys-red.txt).
• Stranger per exception (Grimmory): A/items.txt item 4; R-775 re-measured: 6 tries → the gate's 401, then the household signs in 200 — the 15-minute lock can no longer be aimed from outside.
• 9202 lifecycle (B/box/): Grimmory step 3.4.1 → 3.5.0 behind the gate (58.5 s, book read back); MeTube fresh install (a stranger's 63 polls: 404 → 401, never the app), step .28 → .29 (34.9 s), night backup, remove keeping data, restore (64.8 s / 38.5 s), seeds read back, the gate files and the stranger's refusal back by themselves.
• demo-hp, live catalog (B4/): both installed through the product, strangers 401 through the real internet and the LAN, removed with data; the apps were removed after (STATUS asks whether to keep them).

Found on the way (all register rows)

• R-801 (P2, fixed in the catalog): the volume-persistence gate never sent a request to ANY app — it read the port from label values, the port is in the label name. Fixed (routed_ports()), red-proofed (B/RP-R801-routed-ports.txt). A re-sweep of all 58 templates is owed. Before the fix MeTube answered UNDETERMINED; after, CLEAN with its own download (B/volume-persistence-after-R801.txt).
• R-800 (P2, operator): "remove with data" keeps an app's files in userdata, and the dialog does not say so.
• R-788 (APP_EXERCISE), R-796 (MeTube's send-to helpers cannot pass the gate), R-797 (rule 3 not checkable in CI), R-798 (Grimmory's dead env line), R-799 (fixture field). Licence rows R-789..R-795.
• Harness only (no row): box_walk cached "not gated" while an app had no router (fixed); Cloudflare refuses Python's user agent (error 1010) — a test client detail, the box was never reached.

Rows and gates

• Register 422 → 436: closed R-767, R-780, R-787; updated R-775 (narrowed), R-784 (decided B, draft ready), R-788; opened R-788..R-801 (14).
• Releases: controller v0.287.0 (one release). Catalog 96829d0 (+ the record amendment). Golden 0.287.0.
• CI by head_sha: catalog 96829d0 → job 1201 success; felhom.eu e6d1ebd → 1200 success; controller 9821690 → 1199 success (all pushes of the session green).
• unproven.py --summary: unchanged (not walked 35 of 55).

Teardown

• 9202: both apps removed (keep-data remove; the harness removed its own test folders by hand — R-442 refuses with-data there); back on the live catalog (A/repoint-drill.txt controls); family members anna/bela remain on 9202's card (scratch box, harmless).
• Bench 9401: rebuilt and destroyed four times; pct list 9201 + 9202 only; nvme-scratch back to its baseline.
• demo-hp 9201: apps removed, test files removed by hand, the test member removed (B4/teardown.txt).
• Hub: the floor and the artifact manifest changed on purpose; nothing else. Secrets: scratch files shredded at the end; evidence scanned for every secret value used (0 hits, positive control 1).