docs(1.7.121): pause point — task list, status and resume notes

v1.7.120-alpha is shipped and verified; do not re-cut it. Two fixes landed
after it: federation trust escalation (c0cfc72a) and the lnd-ui OTA pin +
host networking (5088aef5).

The task file now carries a RESUME HERE block with the groundwork already
located for the next item (the password gate on granting Trusted) — the
exact helper, both entry points with line numbers, and the rule that
demotion stays ungated — so the next session does not repeat the search.

Paused here deliberately rather than starting the app-port auth work at
low context: it is the largest item, the operator asked for umbrelOS and
StartOS research first, and it is the same bug class as the leaks fixed
in v1.7.120 but across every app port and transport.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/RELEASE-1.7.121-TASKS.md

@@ -34,7 +34,7 @@ Status key: **DONE** (committed) · **READY** (written, not yet committed/tested
   recreate the running container for it to take effect (`06e0e695`) — the same trap
   applies here.
 
-### 3. Federation trust escalation — **READY** (compiles; tests running)
+### 3. Federation trust escalation — **DONE** (`c0cfc72a`, pushed)
 Two independent fail-open paths granted `Trusted` without any operator decision:
 
 - `federation.peer-joined` is **unauthenticated** (middleware no-session list) and
@@ -73,7 +73,7 @@ trail distinguishes it from the capped automatic ones.
 
 ## P1 — Correctness the operator hit directly
 
-### 4. LND UI never updates over OTA — **READY** (uncommitted)
+### 4. LND UI never updates over OTA — **DONE** (`5088aef5`, pushed)
 - `LND_UI_IMAGE` was `lnd-ui:latest` while `BITCOIN_UI_IMAGE` was pinned to
   `1.7.119-alpha`. Podman will not re-pull a tag it already holds locally, so nodes kept a
   stale lnd-ui forever. **Now pinned to `1.7.119-alpha`.**
@@ -140,3 +140,51 @@ below is dead on every path. Pre-existing; spotted in the v1.7.120 build warning
   bundle renders a black page.
 - Verify security claims on the node, not from the source. v1.7.120's headline bug was a
   fix that shipped in the binary and silently never reached the running container.
+
+---
+
+## RESUME HERE — next session
+
+**Landed this session (both pushed):**
+- `c0cfc72a` federation trust escalation (items 3) — 42/42 federation tests green
+- `5088aef5` lnd-ui OTA pin + host networking (item 4), and this task file
+
+**v1.7.120-alpha is SHIPPED** — signed, published, assets verified live. Do not re-cut it.
+
+### Start with item 3b (password gate) — groundwork already located
+
+Everything needed to implement it, so the next session does not re-search:
+
+- **The helper to use:** `self.auth_manager.verify_password(password).await?` — returns
+  `bool`. Existing callers to copy the shape from: `api/rpc/node.rs:176`,
+  `api/rpc/totp.rs:18` / `:66` / `:121`.
+- **Entry point A — minting a Trusted invite:** `handle_federation_invite`,
+  `api/rpc/federation/handlers.rs:58`. It reads `trust_level` from params and
+  **defaults to `TrustLevel::Trusted` at :72**. Gate only when the resolved level is
+  `Trusted`; leave Observer invites unchanged.
+- **Entry point B — the UI dropdown:** `handle_federation_set_trust`,
+  `api/rpc/federation/handlers.rs:326`, dispatched as `"federation.set-trust"`
+  (`api/rpc/dispatcher.rs:353`). Its parse is at `:342`.
+- **Rule:** gate PROMOTION to Trusted only. Demotion must stay ungated — making something
+  less privileged must never be harder than leaving it.
+- Set `TrustSource::Manual` on the operator path so the audit trail distinguishes a
+  deliberate grant from the capped automatic ones.
+- Frontend will need the password prompt in both places (invite modal, node dropdown).
+
+### Then item 1 (app ports unauthenticated) — the big one
+
+Start with the research the operator explicitly asked for: how **umbrelOS**
+(`getumbrel/umbrel`) and **StartOS** (`Start9Labs/start-os`) gate app access. Read their
+model rather than inventing one. Only then design the gate.
+
+Give this a fresh session with real context — it is the largest item here and is the same
+bug class as the `/lnd-connect-info` + `/bitcoin-rpc/` leaks fixed in v1.7.120, but across
+every app port and every transport.
+
+### Working notes
+- A separate agent is doing **AIUI planning with GSD** — do not touch AIUI.
+- The shared tree has concurrent agents: stage by explicit path, never `git add -A`.
+- Verify security claims **on the node**, not from source. v1.7.120's headline bug was a
+  fix that shipped in the binary and silently never reached the running container.
+- A piped command's exit code is the pipe's, not the script's — redirect to a log file and
+  read the content.

.planning/STATE.md

@@ -5,10 +5,10 @@ milestone_name: milestone
 current_phase: 09
 current_phase_name: BotFights Platform Upgrade
 status: planning
-stopped_at: Phase 13 context gathered
+stopped_at: v1.7.120-alpha SHIPPED; 1.7.121 queue open — see .planning/RELEASE-1.7.121-TASKS.md (12 items, RESUME HERE section at the end)
 last_updated: "2026-08-03T12:57:51.075Z"
 last_activity: 2026-07-31
-last_activity_desc: Phase 02 complete, transitioned to Phase 09
+last_activity_desc: Shipped v1.7.120-alpha (signed+published+verified). Then fixed federation trust escalation (c0cfc72a) and the lnd-ui OTA pin/networking (5088aef5). 1.7.121 task list opened with 12 items; paused for context.
 progress:
   total_phases: 13
   completed_phases: 2