docs(1.7.121): record what shipped, both gate incidents, and the .122 queue

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 02:49:36 -04:00
parent e20d7a14fb
commit 9d225473b1
1 changed files with 64 additions and 0 deletions
@@ -443,6 +443,70 @@ below is dead on every path. Pre-existing; spotted in the v1.7.120 build warning

 ---

+## STATUS 2026-08-04 — what shipped in 1.7.121 and what did not
+
+### Shipped (committed + pushed)
+
+| Item | Commit | Verified |
+|---|---|---|
+| 3. Federation trust escalation | `c0cfc72a` | 42/42 federation tests |
+| 3b. Trusted requires node password | `24ce8b39` | 44/44 + 79/79 + vue-tsc |
+| 4. lnd-ui OTA pin + host networking | `5088aef5` | — |
+| 1b. Manifest `auth:` declarations | `0c4826f8` | 73/73, all 56 manifests parse |
+| 1c. App gate (engine + audit) | `0de67ca6` | 23/23 appgate |
+| Dashboard backdrop-filter seam | `63d0183d` | 3/3, **live on archi-dev-box** |
+| 7. Release refuses unsigned manifest | `cc9e1958` | dry-run: signed/stripped/wrong-signer |
+| Gate safety model (`Option<PortAuth>`) | `ab2c8b6e` | 75/75 incl. LND wallet-port case |
+| Companion rebuild-loop | `719446c0` | podman behaviour proven first |
+| 5. Federated peers messageable | `edc9a172` | predicate pinned across device types |
+
+### The two gate incidents — read before touching the gate again
+
+Both were ONE mistake: a safety decision read an ABSENT manifest field as a
+value. A node's installed manifests always lag the binary, so "absent" is the
+normal state, and the daemon acted on instructions no manifest ever gave.
+
+1. Gating any `session` port regardless of `bind` **published Bitcoin's
+   loopback-only RPC 8332 on the LAN/Tailscale/IPv6** within seconds of deploy.
+2. The `bind`-keyed replacement looked safe (it protected `bind: 127.0.0.1`)
+   but LND's gRPC 10009 / REST 18080 carry an EMPTY bind — one container
+   recreate from pinning them to loopback and **breaking Zeus and every remote
+   wallet**.
+
+Now structural: `auth_policy()` classifies (undeclared → reported as
+unprotected, always safe), `auth_is_declared()` gates action (undeclared →
+never acted on). **Silence is not consent.**
+
+### Proven on the node, empirically, not by reasoning
+
+- Gate challenge → login → proxy works end to end over LAN and Tailscale.
+- **Daemon-side publish rewriting was removed.** Publishes are built in several
+  places (`podman_client`, `package::install`, `stacks`); patching one covered
+  one — the strfry recreate went through another and the pin never fired.
+- **Disk manifest edits do not apply to catalog-covered apps.** Even
+  `bind: 127.0.0.1` written into the node's strfry manifest was overridden by
+  the signed catalog. The catalog re-sign is REQUIRED; there is no shortcut.
+- A loopback-bound host port is **unreachable** from a pasta container, so
+  loopback-pinning the Wyoming ports would break Home Assistant voice.
+
+### Open for 1.7.122
+
+1. **Catalog re-sign** — `bind: 127.0.0.1` + `auth: session` on the ~39 gated
+   UI ports. This is what turns the gate from auditing into enforcing. Nothing
+   in code can substitute for it.
+2. **Release-root rotation** — branch `rotate-release-root`, key
+   `did:key:z6Mkfu5LT…DLWT` / `1578adcc…4418`, validated as a real curve point.
+   **Sign the rotation release with the OLD key**; only the release after it
+   uses the new one. Re-sign the catalog too.
+3. **Wyoming voice ports** (10200/10300/10400) — unauthenticated, and by the
+   operator's policy they should not be. Correct fix is co-locating Home
+   Assistant with the pine services on one container network so nothing is
+   published; needs a node running both.
+4. **Item 2** filebrowser default login. **Items 6/6b** app updates +
+   multiversion (`versions[]` already exists, populated for 2 of 66 apps).
+5. **`cargo-test-weekly` times out** at its 1500s cap on a loaded box — raise
+   the cap or split the stage; it is not a code failure.
+
 ## RESUME HERE — next session

 **Landed this session (both pushed):**