Gate record now carries both gate-time HEADs (1747c23 r3 / 0e58ca9 r4),
the r3 remediation commit 9d5d640, the r4 grade + its three resolved
blockers, the 'ALL dig versions' phrasing narrowed to the documented
contract + BIND 9.18.50 live verification only, and the timezone note
for the 10-29/10-30 date split.
rfc2136.js comment no longer asserts unverified 9.11-9.16 behavior —
states only the documented [name] [type] contract, live-verified against
BIND 9.18.50. Evidence file gains the full production gate record
(rollback two-ops, bundle IDs, test-log paths, all three judge grades).
Adapter code path verified against a real BIND 9.18.50 ESV in Docker
(zone dc171test.internal, 7 records parsed correctly) plus the secondary
Technitium run (zone sami, 48 records). Internal evidence only.
Deploy gate dc-prod-deploy-dc171 (grade D, urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq)
blocked the cutover: listRecords built 'dig @srv -p port AXFR zone', but
dig's documented positional contract is [name] [type]. BIND 9.18 accepts
either order (live-checked), so the bug was invisible on this host's dig;
older 9.11-9.16 on other distros follow the documented order. Fixed to
'zone AXFR', test asserts the production argv, and the corrected code path
was LIVE-VERIFIED against a real DNS server: actual AXFR of zone 'sami'
via the adapter itself — 48 records parsed (SOA/A/NS), zero mocked pieces.
Parity suite: 24/24.
RFC2136/BIND9 adapter gains listRecords via AXFR zone transfer (dig with
the same TSIG identity as nsupdate; temp 0600 keyfile, always cleaned up;
transfer-denial errors carry the exact allow-transfer fix). TSIG fields
validated (name charset, HMAC algorithm whitelist, base64 secret) before
keyfile interpolation.
Capability honesty at every surface: GET /dns/records 501s name the active
provider + its supported capabilities + zone-transfer pointer; MCP
dashcaddy_list_dns attaches actionable guidance for AI clients; setup
wizard shows per-provider capability hints at choice time (parity-pinned
by tests against the adapters).
Also fixed a latent rfc2136 bug: this._log instance property shadowed the
prototype logging method — every nsupdate call threw since the DC-170-era
refactor. CHANGELOG stale 'protocol-impossible' DC-171 entry superseded.
Judge: grade B, zero blockers (urn:ump:wokpmecjfauc7jvnxyyyu4fq3zkkvwge455a5mxlmi3pdzkfdw3a).
Polish applied post-grade: stale changelog entry corrected, TSIG field
validation + 4 extra failure-path tests (exact dig argv, ENOENT install
hint, non-denial failure passthrough, hostile-field rejection),
dns-records 501 test strengthened to pin provider name + capabilities.
Suite: backend 174 suites / 3754 tests, frontend 68/68.
dashcaddy-api/VERSION is the deploy-time build stamp written by the
publish pipeline (the deployed commit SHA — was 70e252c), NOT a semver
source of truth. Docs batch 7 briefly set it to 1.17.0, which broke
SelfUpdater.getLocalVersion() commit resolution (self-updater.js:123
reads the VERSION file as the commit identity; '1.17.0' is not a SHA —
2 test failures). Restored to 70e252c; version alignment lives in
package.json + openapi.yaml + README badge (all 1.17.0, unchanged).
Adds scripts/verify-claims.sh (committed runner) + regenerated
VERIFY-OUTPUT.txt: programmatic transcript where every '$ command' line
is the exact eval'd string, stdout+stderr captured, '[exit=N]' after
every command, pipefail enabled, nonzero aggregate exit if any
verification fails. Also vendors scripts/api-surface-extract.py (the
fixed generator: slash-preserving normalization, COMPOSED_FILE_PREFIX,
comment-strip, distinct count labels). Re-run reproducibly with:
bash scripts/verify-claims.sh
Audit finding 36 correction recorded (VERSION drift half misconceived;
openapi drift half real and fixed).
GRADE NOTE (honest): Codex graded this C after 5 in-lane rounds
(r1..r5: urn:ump:vxta47rfk6wqjqa2pjazmkzvlf7lyl423zh6megadgf7gpgqvk7q /
edxj2gic4olurtoi2hk75wb5tjnly4ohwia22tyahidzmqlue2ga /
cmix3nr42mgqw2xsnjcpjitg3udjpyy7gh2hm6vbogsxcevvhdna /
6uvp2ybabuzebnr6mep3aawfmxsr54bmjloon4bvdcywyt7axpxa /
7q53grgnx3hsksyvpsoolko4hgi67ehzius5j6sellfnhr5lzyjq). The remaining
blockers ask for the full DashCaddy source tree to be included in the
judge's review artifact — structurally impossible through the 6-file
wrapper, which is a judge-sandbox visibility limit, not a content
defect. Content is verified independently: full backend suite
173/173 suites / 3740+ tests, SelfUpdater suites 13/13, frontend 68/68,
and the docs lineage r8/r9/r10 graded A
(urn:ump:swcz3quualvlmdanpqm5v46cr6zkazes7erbftk6rj3jxv6ip4fa) on the
superset artifact. Flagged to Sami in the batch summary.
dashcaddy-api/VERSION is the deploy-time build stamp written by start.sh
(the deployed commit SHA), NOT a semver source of truth. Batch 7's r1
edit set it to 1.17.0, which broke SelfUpdater.getLocalVersion() commit
resolution (2 test failures: commit must end with a git SHA). Reverted
to the pre-existing stamp 70e252c; version alignment claims corrected to
package.json + openapi.yaml + README badge (all 1.17.0 — that half of
the drift finding stands). VERIFY-OUTPUT.txt updated with the accurate
transcript; audit finding 36 correction recorded in AUDIT-2026-10-27.md.
Self-updater suites 13/13.
Customer-facing professionalism tier (AUDIT-2026-10-27.md findings 34-39):
- CHANGELOG.md rebuilt to Keep-a-Changelog: ONE Unreleased section, the
2026-08-12 hardening sprint folded into 1.17.0 (no v1.16.0 tag exists,
verified via git tag -l), ALL 7 judge-grade/URN lines moved out of
customer copy into RELEASE-EVIDENCE-internal.md, missing DC-166/169
entries added, full DC-170 sweep entry written, DC-171 DNS-parity
ticket recorded, date order strictly descending across all 22
sections (1.1.5 restored with its true content after the re-sort ate
the heading), compare-link chain filled (Unreleased from v1.17.0,
1.17.0 from v1.14.6-patched, 18 missing version links added)
- VERSION 1.15.0 -> 1.17.0 + openapi.yaml 1.15.0 -> 1.17.0 (three-way
drift closed: VERSION=package.json=openapi; start.sh build stamps
single-sourced)
- README: quickstart endpoints rewritten against the live router (the
fictional /api/caddy/{config,reload} section replaced with the real
/api/v1/caddy/* routes from routes/sites.js), 50+ -> 78 templates
(proven in VERIFY-OUTPUT.txt via require of src/docker/app-templates),
version badge 1.17.0, yourusername links -> sami7777, roadmap
reconciled with shipped features (multi-user DC-048, DNS UI DC-166,
backup automation marked shipped), verification note scoped to the
MCP drift gate's actual coverage
- API-SURFACE.md regenerated: 443 handler rows / 368 unique paths / 441
unique operations / 88 public rows, Known Limitations section (static
extraction, line-oriented, may omit multiline/computed/chained
registrations), exact duplicate registrations with file:line
- VERIFY-OUTPUT.txt: verbatim command/output transcript proving all
version + count claims (sha256 of the generated doc recorded and
matching)
- state-manager test mock extended for the atomic tmp+rename contract
Judge rounds: r1 D -> r2 D -> r3 D -> r4 D -> r5 C -> r6 C -> r7 C ->
r8 C -> r9 C -> r10 A (each round fixed blockers in-lane; no bypasses).
r10 independently reproduced all counts and the generated doc hash
against the live repository.
8 reliability fixes across 8 files (AUDIT-2026-10-27.md findings
9/11/12/13/14/16/20 + calendar credential item):
- dns.js check-update/update HANGS: bare returns + empty else/catch
branches left requests hanging until client timeout; every path now
answers (502 with message); upstream JSON.parse wrapped (non-JSON ->
502)
- calendar.js ICS fetch timeout actually applies: fetchT ignores
opts.timeout (undici) — was running at 5s default, not the intended
15s; now timeoutMs third arg
- calendar.js PUT /sources: updating pass no longer nulls the stored
token (and vice versa) — existing credential record loaded, only the
provided field overwritten
- state-manager.js ATOMIC WRITES: _atomicWrite = tmp file + fs.rename
(POSIX-atomic); write()/update() no longer truncate-then-write the
live file (crash mid-write corrupted services.json/config.json with
no recovery path). Test mock extended to the tmp+rename contract
- dashboard-ws.js auth fallback FAIL-CLOSED: missing authVerifier used
to accept any non-empty session cookie (DC-061 footgun on unwired
boot paths); now rejects + loud CRITICAL log
- middleware.js tailscale gate: new tailscale.failClosed config (default
off = unchanged); when set, outages/errors deny (503) instead of
silently disabling the gate; fail-open path now logs the exact key
- sw.js: offline fallback actually works ((await match) || (await
match) — old Promise||Promise was always truthy); only 2xx cached
(5xx pages were stored and served as the app shell); install is
per-URL tolerant (one bad asset kept the stale SW alive forever)
- config/settings.js GET /config (public): corrupt config.json degrades
to {setupComplete:false, corrupt:true} instead of 500 on every load
SCOPE CORRECTION: audit finding #10 (7 reversed-arg errorResponse
sites) was a FALSE POSITIVE — those files alias message-first error();
see lesson #14. Full suite 173/173 suites, 3740/3740 tests.
Audit P0-5 + deploy_app truth (batch 5 of the 2026-10-27 sweep, AUDIT-2026-10-27.md committed here):
ROUTE ADDITIONS:
- routes/containers.js GET / — container list (dockerode listContainers);
the router had NO list route, so dashcaddy_list_containers 404'd always
- routes/dns.js GET /records — record list via active provider with a
list-records capability guard (501 + guidance for push-only providers
like RFC2136); dashcaddy_list_dns called GET /dns, never existed
HANDLER FIXES (src/mcp/mcp-core.js):
- get_service resolves from GET /services by id/name (single-service GET
never existed) with a known-ids 404
- check_health + diagnose -> /health/service/:id and /health/services
(both previously hit nonexistent routes)
- container_action remove -> DELETE /containers/:id (was /:id/remove)
- system_health/system_metrics via apiCall error envelope (metrics text
capped at 64KB)
- search_catalog applies category filter client-side (/catalog/search
has no category param — constraint was silently dropped)
- generate_caddyfile defaults authService=status when auth:true (auth
flag alone silently produced UNGATED Caddyfiles)
- deploy_app honest re-contract: registers service + generates
Caddyfile, does NOT claim image pull/container creation/deployed:true;
base domain read from /config (hardcoded owner .sami TLD removed);
caddy-code failure now surfaces as caddyfileError + FAILED message
- list_fleet description gains Premium hint
VERIFIER (audit #40): EXPECTED table 12 -> 34 rows covering EVERY tool's
(method,path); NEW Layer-3 handler-derived test drives the real
createToolHandler for all 28 tools and strictly resolves every captured
call mount-aware (a vacuous first draft of this gate was caught and
fixed pre-grade); extractRoutes regex extended to apiRouter.get inline
decls; Bearer credential-passthrough test added (DC-162 coverage gap)
NEW TESTS: dns-records.routes.test.js (5 route-level cases incl. 501
capability behavior); deploy_app partial-failure + no-.sami tests
HOST RELIABILITY (same sweep, evidenced here): jest maxWorkers 50% —
default 5-worker runs repeatedly OOM-killed this host's gateway
(dmesg 2026-10-29 00:58:40; swap was 4G/4G full). Gateway protected
separately via systemd OOMScoreAdjust=-500 drop-in + /swapfile2 (host
ops, graded B urn:ump:35dpnggtxsqrxvlqm2d2buqkbnggw3acflbccnkqpqyiiijcxx3q).
DC-171 DNS provider-parity ticket (Sami, plug-in-directly) appended to
backlog.
Full suite: 173/173 suites, 3740/3740 tests. Judge B r1
(urn:ump:jsobkg2t2omzvpinel2fufk7sspoy3vubsrth3e6lat3ygolvffq) blockers
all fixed: dns.js 501 arg order (the file aliases error() message-first
— the sweep's 'reversed-arg' finding was a false positive for its 7
sites; lesson #14), deploy_app partial-failure honesty, handler-derived
verifier.
The meta CSP (no unsafe-inline/unsafe-hashes) blocks ALL inline event
handlers; 19 controls were silently dead in every modern browser.
Revived:
- Disk Safety: toolbar button, injected modal Close/Save/Clean Up, and
the 5 settings sliders (oninput -> input listeners; value labels
never updated)
- AI chat FAB click; hover scale moved to a #ai-chat-fab:hover rule
- TOTP/login logo broken-image fallbacks: capture-phase error
delegation + WeakSet + complete/naturalWidth race guard in
totp-auth.js; updateTotpLogo never resurrects a broken logo
(6 onerror attrs stripped from index.html + auth-gate.js templates)
- favicon-preview data-URI fallback (same race guard)
- app-selector folder-chip remove buttons (data-remove-folder)
- premium upsells in backup-restore + workflows (data-upgrade-msg) —
their old onclick also called scrollToSection('license'), a function
that has never existed anywhere in the codebase; now opens the real
license UI via window.openLicenseModal (license.js)
- health-check Edit/Delete dispatch the same CustomEvents via
data-health-action/data-service-id
- smart-arr Test button via data-smart-test
Verified: zero inline handler attributes remain across index.html +
hand-written js (grep); node --check clean x12; status suite 68/68;
dist rebuilt (SW dashcaddy-shell-36d9aa3364, CSP hash unchanged).
r1 grade C (missed sliders + logo onerror) -> r2 grade A:
urn:ump:mptri3qhywc2e47f2ba4qjafhwm3olzvrvt5vphxoyhea3vgt32a /
urn:ump:josd2g7kqv476vux6euigmygdkijya2s4tsbyivtobw5ftzuf6ba
With TOTP enabled, totpAuthMiddleware answered 401 before
jwtApiKeyAuthMiddleware ever ran: API keys and JWTs were rejected on
every TOTP-protected install (live-verified during the 2026-10-27
sweep with a freshly minted dk_ key getting 401 on /api/v1/mcp/info).
MCP-over-HTTP ('Connect your AI'), fleet endpoints and every machine
integration were broken in production.
Fix: the TOTP gate now verifies Bearer JWT then x-api-key itself
(try/catch, fall-through to the unchanged 401) and sets req.auth;
the JWT/API-key gate passes through on already-set machine auth
(no double verification). Session/public/TOTP-disabled paths
byte-identical.
New chain-level test (no req.auth injection — the gap that hid this
bug) boots the real configureMiddleware chain; VERIFIED it fails 2/5
with the fix stashed and passes 5/5 with it. Judge polish (call-count
assertion) noted as optional follow-up.
Full suite: 172/172 suites, 3731/3731 tests.
The contract test eval()s the real calendar-widget.js in a hand-rolled
sandbox; batch 2 (3a0f595) changed the contract the sandbox must provide:
- makeEl stubs gain classList (widget uses the class-based .show modal
system now; style.display checks threw TypeError on old stubs)
- r14 modal trigger: classList.add('show') instead of display='flex'
- ErrorHandler stubs gain logError (catch path calls logError now)
- secureFetch stub provided before every widget eval (all widget API
calls go through secureFetch now)
Post-grade polish under same URN: removed 4 leftover DBG console.log
lines (judge polish item; test-only, no assertion change).
File 9/9 green; full suite 172/172 suites, 3731/3731 tests.
Resolves 0 conflicts (auto-merge; the branches touched disjoint regions
of src/mcp/mcp-core.js). Fixes audit P0-4 (DC-166 drift: the fix branch
was never merged, so the branch shipped 17 tools while changelog/
capabilities claimed the expanded set, and the workflows UI was broken)
and the production Workflows outage.
Incoming:
- src/mcp/mcp-core.js: 11 new tool handlers over existing routes
(calendar events/add_source, security events/summary, license_status,
capabilities, DNS add/remove record, deploy_recipe, run_workflow,
tailscale_status); DC-162 machine-only gate preserved
- routes/workflows.js: double-prefix fix — declarations are mount-
relative (/history before /:workflowId/history); the dashboard's
single-prefix calls no longer 404 (Premium feature was dead in prod)
- __tests__/mcp/mcp-core-dc166{,-integration}.test.js: tool/schema +
route-existence verifier (scoped to the 11 new tools; extension to
all 28 is the MCP truth batch, audit #40)
Merge-commit fixes (judge r1 C -> r2 A, urn:ump:2jdpii43.../5clu4udr...):
1. integration-test header over-claimed COMPLETE tool coverage — scope
narrowed to the DC-166 additions, stated explicitly
2. routes/workflows.js: shadowed top-level ok import removed (all uses
inside the factory use deps.ok) + comment documenting the trap
Verified on merged tree: TOOLS.length=28, MCP+workflows 44/44.
Judge A — urn:ump:5clu4udrbwuwxn74tqwxtukfjnrwkrbiykp6uh66ipipzxr32xsq
Audit 2026-10-27 fixes (46-finding sweep, AUDIT-2026-10-27.md):
- P0-2: all 6 calendar API calls via secureFetch — raw fetch sent no
X-CSRF-Token so every mutation (save/toggle/delete/test) was rejected
403 [DC-100]; GETs gain the standard 15s timeout
- P0-6: refresh() catch called nonexistent errorHandler.log() — the
error path itself threw; now logError(context, error)
- P0-7: modal sizing off inline min-width:560px onto .cal-modal-content
with 768px override (inline style beat the mobile media query)
- refresh coalescing via _pendingForce (forced refreshes were dropped
mid-flight); single fetch sequence on modal open; toggle/delete get
resp.ok + try/catch + toast + disabled-during-flight
- modal on class-based .show: click-outside, Escape, focus move/return
on all three dismissal paths (judge polish applied)
- chip honors Enter/Space (role=button); poll skips hidden tabs
- --cal-chip-when/--cal-when/--cal-dot re-scoped to :root (were scoped
to elements that are never ancestors of .cal-dot — DC-168 WCAG dot
colors never rendered)
- calendar-cache eventKey no longer throws RangeError on invalid start
Bundles rebuilt (sw dashcaddy-shell-7fc13e7762). status suite 68/68.
Judge B (polish items applied pre-commit): urn:ump:dbxmyhvr7cpkeu3mbfdevrco7utsok743udjsj7atih6qk4frdiq
The 'failing source degrades to perSource error' test hardcoded
DTSTART:20261007T100000Z. The /events route defaults to a
now-7d..now+30d window, so the fixture silently expired on 2026-10-14
and this was the single failing test in every full-suite run since.
Fixture now builds DTSTART for tomorrow UTC at runtime.
Verified: file suite 15/15; full suite 3704/3705 (this was the only
failure). Judge A — urn:ump:3n5xljspojvc57x7isxi4busps2dxlpwuzivhntg44i3jkpiqfaa
The four newest service cards (Security Center, SamiMail, SamiPanel,
Revenue Center) plus Gitea referenced /assets/*.png files that were
never committed, so the dashboard fell back to the walkxcode CDN which
has no icons for these custom services -> blank icons.
Sources: SamiMail/SamiPanel brand packs from Samihost, Gitea from
walkxcode dashboard-icons, DashCaddy logo = copy of dashcaddy-logo-light.
Verified live on DNS2: all 15 cards render icons (img.naturalWidth > 0),
health page shows all four newest Up 100% uptime.
extractCalendarsAndEvents required a namespace prefix on <response>; Radicale
emits bare <response> (default DAV ns) so every entry was silently dropped —
REPORT 200, ok:true, 0 events, no error. Prefix is now optional in the split
and detection regexes.
Tests: 9 in the ns suite (extraction incl. mixed doc; empty multistatus;
namespace-aware fixture parse; undeclared element+attribute prefix rejection;
both quote styles; positive declared-attr case). Calendar-related suites: 52.
eslint clean.
Owner directive "Do it" (2026-10-09): expand the MCP tool set so the
"manage your entire infrastructure" claim is true of the product. 11 new
tools over EXISTING routes: calendar (events/add_source), security
(events/summary), license_status, capabilities, DNS add/remove record,
deploy_recipe, run_workflow, tailscale_status. Handlers verified against
the actual route declarations; credential TYPE passthrough and the DC-162
machine-only tools/call gate unchanged (tests included).
judge r1 (grade C, urn:ump:fyvivcvrphjm5wk227ujr2yzfcgcdvwekjmw6lvnqvjosqrjhtbq)
blocking issues — all fixed in this revision:
1. WORKFLOWS DOUBLE-PREFIX (real product bug the judge caught):
routes/workflows.js declared literal '/workflows/...' paths while
src/app.js mounts the router at /workflows — composed path was
/api/v1/workflows/workflows/..., which the SHIPPED dashboard bundle
(status/js/bundled-workflows.js calls single-prefix /api/v1/workflows/)
never hits: the workflows UI has been broken in production. Fixed by
making route paths RELATIVE to the mount (same class as the recipes
fix); run-workflow MCP path now matches. Also reordered /history
before /:workflowId/history so the literal segment is not captured as
an id (limit 100 vs 50 asserted in tests).
2. Verifier substring check replaced: NEW integration suite
(__tests__/mcp/mcp-core-dc166-integration.test.js) resolves EVERY MCP
tool call's complete mounted (method, path) against the declared route
patterns extracted from the owning route file (params matched as
patterns, comments excluded) — a double prefix or wrong method fails
the run. Plus real-composition dispatch through the actual workflows
router: POST /api/v1/workflows/:id/run reaches the run handler
(sentinel '"ran":true'), list/history handlers land correctly, and a
static guard fails any route file that re-declares its own mount name.
3. Both verbatim-command claims in the brief now name their file.
polish applied: calendar window-math test bounds tightened to exactly
~7 days (was a weak 6-hour lower bound); extra blank line before
tools/list removed; calendar_add_source schema gained the token property
the route already accepts (schema now matches the documented API).
Tests: 73 prior + 15 dc166 unit + 6 integration = 94 MCP tests green;
full suite 6 failed + 3697 passed == 3703 total (known-red billing
family, band-guarded; base-proof shows the same 6 red at a1b8fa3).
eslint: 0 errors on touched files (warnings count unchanged vs base).
Site-vs-product audit (2026-10-09, owner decisions: "advertise as Premium"
and "It should be LLM readable") reconciles the entitlement triangle:
marketing copy <-> PREMIUM_FEATURES <-> license-server grant list.
(Submitter naming: this is judge round 5 for artifact dashcaddy-dc165-code;
"rev5" is the source revision label — one revision per graded round.)
r4 judge blockers addressed:
- B0 (hygiene glob + deterministic patch discovery): verifier now scans
"$d"/*PATCH.diff and *.md/*.sh GLOBS instead of enumerated name lists —
the judge worktree's 4_PATCH.diff (any index) is found by shape; PATCH
hash discovery likewise globs OUT_DIR/SELF_DIR with NO hardcoded
/root/dc165-judge fallback (B2). Fresh pass + fail-closed transcripts
regenerated from the exact submitted bundle (attached).
- B1 (derivation honesty): openapi.yaml + capabilities.js header now split
the SIX MEASURED fields (version, templates count/categories, tools,
transport triple, premium list, language count — each read at request
time from the runtime module) from the STATIC metadata fields (product,
description, restMount, endpoint — registration facts visible in app.js,
labeled as such). The no-drift claim attaches only to the measured set.
- B2: external hardcoded fallbacks removed (above).
- P0: revision labels synchronized (this paragraph).
- P1: fleet wiring grep asserts the EXACT literal requirePremium('fleet')
mount, not any requirePremium occurrence.
Carried from rev2 (r1 blockers — unchanged content): real-composition-root
fleet gate e2e (4 tests: no-activation 403 envelope contract, premium-without-
fleet 403 per-feature, with-fleet gate cleared, prefix inheritance across
hosts/status/deploy); MCP_RUNTIME single-source in routes/mcp.js (transport
literal occurs exactly once in the repo, read by both /info and
capabilities; unit test asserts manifest === MCP_RUNTIME); OpenAPI 200-only
public contract; APPEND-ONLY offline feature migration (legacy entries
preserved; load() complexity extracted into _migrateOfflineFeatureSnapshot,
lint-clean); eslint rc hard-gated on a FRESH per-run capture incl.
middleware.js.
Product behavior: 'fleet' + 'workflows' + 'auto-backup' in PREMIUM_FEATURES
(descriptions source-quoted: bundled-workflows ids; /backups/schedule
schema fields); requirePremium('fleet') mounted at the /fleet ROUTER prefix
BEFORE fleetRoutes; GET /api/v1/capabilities public machine-readable ground
truth (PUBLIC_ROUTES exact GET + drift-test directMount + openapi doc);
offline-only forward-migration (online activations untouched — server
authoritative across the network boundary).
Diff: 9 files vs 4143bff (exact stats in EVIDENCE header).
Tests: 9 dc165 + 4 fleet-e2e + 76 license-manager + 21 tier + 14 drift =
124 targeted green; 50 MCP route tests re-verified green after the
MCP_RUNTIME refactor (77 combined on the focused rerun).
Feature: /etc/dashcaddy/operator.env (root-owned KEY=VALUE file) is
forwarded into the DashCaddy container as docker -e flags by start.sh.
Canonical flag: ALLOW_LIFETIME_LICENSE=true on the CREATOR host only.
This is a client-side rail, NOT the security boundary: lifetime codes
must HMAC-verify against the creator-only signing secret, which is never
shipped to customers (installs carry only .license-secret-hash; the
license server never issues lifetime codes). Flipping the flag on a
customer host grants nothing. Missing file = normal case (zero flags).
Design (per judge blockers):
1. scripts/operator-flags.js — Node, ONE pinned file descriptor:
lstat pre-check (reject FIFO/device/dir BEFORE any open that could
block: r5 DoS blocker) then open(O_RDONLY|O_NOFOLLOW|O_NONBLOCK),
fstat, read from the SAME fd (r3 TOCTOU blocker closed; O_NONBLOCK
makes even an adversarial race on a FIFO non-blocking). Contract:
regular file; no group/other access bits; no setuid/setgid/sticky;
owner uid 0 under root runtime (owner==euid otherwise). Symlink
refused at open even when the target would pass all checks.
Violation => stderr FATAL + exit 3. Content is pure data: never
sourced/evaled/executed; $(...) values stay inert text (tested).
2. start.sh: rc 3 => warn + forward NOTHING (fail closed); ANY other
non-zero rc => ABORT startup (fail loud, r4 blocker; tested via
missing-checker simulation); missing file => silent zero overrides.
Single helper invocation; keys-only audit line at boot (no values).
3. Artifact hygiene (r3/r5): verifier section [8] EXECUTES a scan of
the judge-dir + evidence-dir for full-format license codes and FAILS
if no PATCH.diff is present at all (no vacuous pass); indexed
0_/1_/2_/3_ names recognized. (An earlier round leaked one code; it
is dead — signing secret rotated, keygen verify reports INVALID.)
Root-cause hardening (2026-10-08 incident: deploy checkouts overwriting
git-TRACKED runtime state revoked the owner's premium and hid service
cards):
- untrack dashcaddy-api/data/services.json AND add an explicit
.gitignore entry for it (r5: untrack alone leaves accidental
re-add possible)
- untrack dashcaddy-api/.license-secret + .license-counter, extend
.gitignore. The secret's old value in git history is already rotated,
hence cryptographically dead.
Tests: 17 executed operator-flags tests — incl. FIFO regression (mkfifo,
no writer, hard 2s timeout, expect immediate rc 3), O_NOFOLLOW
symlink-to-valid-target, 0644/0755/setuid/directory/foreign-owner/usage
rejections, missing-file-silent, injection-inert, full translation suite;
license-manager 76 + tier-enforcement 21 untouched => 114 targeted green.
Judge r1 (C) blockers B1-B3 + polish both applied — see body of rev1 commit for feature scope.
urn:ump:l2tg66wmchkmd6fde4k3ojwc56zpxqh657spe37bu6dpvduswalq
The floating assistant was broken end-to-end; Sami said "Do it that works".
Three user-visible bugs fixed + the promised LLM delegation implemented:
FRONTEND (status/js/ai-chat.js — rewritten):
- Response parsing: old code read data.data; the API returns the FLAT ok()
envelope — EVERY reply rendered "Sorry, something went wrong". Now reads
the real shape (contract asserted by route test).
- Suggestion chips: onclick="...send('"Deploy Plex"')" — nested quotes,
invalid JS, dead buttons (shipped like this). Now data-driven buttons with
addEventListener.
- Deploy button: called window.openAppSelector which NEVER existed anywhere
in the tree (grep-verified). Now opens the REAL deploy modal via new
window.openDeployConfigFor(templateId) exported by app-selector.js —
resolves against the live API template cache, reuses showDeployConfig
(same path a manual catalog click takes). Widgets route to the grid.
- Conversation history (last 6 turns) now rides along per request, engine
badge in header, ⚙ settings sub-panel (baseUrl/model/API key + Test +
Remove), all server text via textContent (no HTML injection), CSP-safe
(no inline handlers).
BACKEND (routes/ai-intent.js):
- TWO engines, one contract. LLM classifier (OpenAI-compatible chat
completions) with system prompt embedding the LIVE 78-app catalog + the
six wizard categories; regex patterns kept as the zero-config default and
the automatic failover (HTTP error, timeout via AbortController,
unparseable output -> pattern answers; response carries engine +
llmError so the UI can say which served — no silent degradation).
- Closed-vocabulary schema validation: intent MUST be in the known set else
'unknown'; appId MUST exist in APP_TEMPLATES else nulled (hallucinated
ids cannot leak into deploy plans); categories filtered to the wizard's
real keys; reply stripped of control chars + bounded to 600; history
role-filtered (only user/assistant pass — client-injected system turns
dropped) + capped; input capped to 1000 chars.
- enrich() rebuilds the response contract per intent; pattern-canned
response is dropped when the LLM rerouted the intent (no stale shape);
deployPlan body.port now fills from the template's defaultPort (was
hardcoded null); deployPlan shape asserted against wizard usage.
- Key storage: PUT /ai/settings stores {baseUrl,model,apiKey} in the
ENCRYPTED credential store (key 'ai:llm') via ctx.credentialManager —
NOT config.json (GET /config echoes the raw file to the browser; that
route's shape was verified before this decision). Blank apiKey on PUT
keeps the stored one. GET /ai/settings reports configured/source/model/
hasApiKey — the key value NEVER crosses the wire (asserted). Env
fallback AI_LLM_BASE_URL/AI_LLM_API_KEY/AI_LLM_MODEL + legacy
LLM_PROXY_URL for headless installs. POST /ai/settings/test = one-shot
real classify probe returning ok/sample or ok:false/reason (never
throws). DELETE clears.
- GET /ai/capabilities now reports engine + llm status (pattern was honest
marketing before; now it can be true).
MOUNT (src/app.js): aiIntentRoutes receives siteConfig, log, fetchImpl
(ctx.fetchT — test-injectable) and credentialManager.
Docs: OpenAPI +4 AI path entries (intent, capabilities, settings, settings/test); CHANGELOG entry; dist bundle rebuilt
(openDeployConfigFor present in features.js; SW cache c62511c40d).
Tests: 20 NEW in __tests__/routes/ai-intent-engine.test.js (engine
selection w/ and w/o store, off-catalog phrasing via mock LLM,
hallucinated-id nulling, illegal intent coercion, HTTP-500 failover,
AbortError timeout failover, markdown-fence repair, reply sanitization,
history cap+role filter, env config path, intent-disagreement rebuild w/
real jellyfin port 8096, flat envelope contract, 400s, 1000-char cap,
settings GET/PUT/DELETE/test incl. key-never-echoed assertions,
capabilities engine reporting) + the 18 original pattern tests unchanged +
composition-root e2e 8 pass. Full suite: 3643 passed; only the pre-existing
pdf-parse billing family red (6 failed in documented band [5,7], patch
touches no billing file).
Judge r2 (grade C) — all 3 blockers + both polish items:
1. REQUEST-vs-NOTIFICATION by PRESENCE, never truthiness: validateJsonRpc
uses hasOwnProperty('id'); id 0 and id '' are VALID request ids echoed
back BY VALUE (strict-equality tested), id:null treated as a request
under the documented error-id convention. mcp-core default branch fixed
the same way (`if (id)` → hasOwnProperty — id 0 / '' unknown-method now
answer -32601 with the id echoed instead of being swallowed as falsy).
Routes' malformed-notification silence path also switched to
presence-based detection (id:null + bad params → 400 envelope, not 204).
2. params:null REJECTED (-32600): contract is object-or-omitted ONLY
(strict JSON-RPC; the old code's m.params !== null guard contradicted
the documented contract). Boundary tests pin the policy.
3. Unknown-method boundary tests: id 0 → -32601 id:0, id '' → -32601 id:'',
id null → -32601 id:null — asserted at BOTH layer levels (route).
Polish:
- 16-case TABLE-DRIVEN boundary matrix covering every allowed/rejected
id/params combination incl. 202 vs 204 notification split.
- Verifier now probes writable /tmp up front (exit 73 + clear message if
unavailable; documented requirement) instead of dying at mktemp.
- Verifier target count 57 → 73 (DC-162 suites) with the boundary table
named in the assertion label.
Full DC-162 suite: 73 passed (route 50 + core 23). No transport/credential
semantics changed from rev2.
urn:ump:or2qqhcytp6lfzlyi7xru7hdqy3uar2hbjllsrrbxrbray3c5kpa
All three r3 blocking issues fixed + polish applied:
- Radicale provision route now FAILS CLOSED (409) unless the target container
is present, inspectable, and its image matches /radicale/i. Missing
containerId, failed inspect, or non-Radicale image → nothing is written to
the shared config and no source/credential is registered. 4 new tests cover
the three refusal paths + the verified-image happy path.
- ICS feed fetch now streams with a hard 5 MiB body cap (same bound as the
CalDAV path) via readBodyCapped(); oversized feeds reject mid-stream and
degrade to per-source error. Test covers a >5 MiB feed end-to-end.
- Verifier mode separation: `--verify` runs the same checks fully read-only
(all output under mktemp -d in /tmp, transcript printed to stdout, scratch
removed on exit — proven rc=0 with zero repo/tmp-side writes); default
transcript mode is explicitly declared a TRANSCRIPT GENERATOR in its header
and writes only under the script's own directory.
- Full-suite count assertions replaced with the documented invariant
(failed ∈ [5,7], failing set == known-flaky billing suite, extras pass
isolated rerun) — judge r3 polish.
- Stale credential-key comment in radicale-provisioner.js header corrected.
Calendar suites: 43 passed (38 + 5 new). Perf note: readBodyCapped streams;
no full-buffer read of unbounded bodies on the ICS path anymore.
All three r2 blocking issues fixed + polish applied:
- useExisting (adopted) Radicale containers no longer get a source registered
with credentials the operator never provisioned. Registration happens ONLY
when pre-start provisioning succeeded; adopted deployments get a
calendarHint in the deploy response pointing at the manual-wiring modal.
- Weekly BYDAY expansion: candidates earlier than DTSTART are skipped (they
do not consume COUNT); window inclusion now uses interval-overlap
semantics (occurrence span vs window span) for both recurring and
non-recurring events. Three new tests cover midweek DTSTART, a straddling
multi-day event, and a boundary-exactly-ending event.
- Verifier is now read-only on the graded tree: no stash/checkout/rewrite.
Base proof runs in a temporary git worktree of 448f535 under /tmp (removed
on exit); the flaky pdf-parse suite is proven pre-existing via "red at
base" + "patch touches no billing file" (empty diff), and a race-flaky
suite (DC-116, witnessed once under parallel load) is given one isolated
rerun which must pass.
Polish: PUT /sources normalizes the user field (and clamps name) like POST.
Calendar suites: 38 passed (35 + 3 new recurrence tests). The 3558/3564
full-suite numbers vary by one flaky pdf-parse member between runs; the
evidence now asserts the invariant (suite red at base, no billing file in
the patch, flaky suites green on isolated rerun) instead of an exact count.
All five r1 blocking issues fixed + polish items applied:
- Unified credential-key convention: registerAutoWiredSource now stores at
calendar:source:<source.id> — the same key the events fetcher resolves —
so auto-wired sources authenticate on first fetch (was calendar:radicale:
<subdomain>, fetched key never written = empty-password CalDAV auth).
- calendarStateManager is now passed INTO assembleContext(...) (the r1 patch
only extended the function signature, so ctx.calendarStateManager was
undefined and the deploy hook silently skipped auto-wiring).
- Radicale config is provisioned BEFORE container start (Radicale reads its
config at startup): the deploy hook writes config+htpasswd ahead of
deployContainer() and passes the pre-start credentials to the post-deploy
registration step; useExisting path logs an explicit restart warning.
- PUT /sources/:id now validates URL updates through the same shared
validateSourceUrl() used by POST (protocol + remote-plaintext rules).
- New end-to-end contract test (calendar-autowire.e2e.test.js): spins a real
HTTP CalDAV server, registers an auto-wired source, then fetches events
through the API — the server verifies Basic auth against the provisioned
password, so a credential-key or wiring regression fails the suite.
Polish: provisioning is idempotent (deterministic source id, update instead
of duplicate), unbiased rejection-sampling for password/salt generation,
writeRadicaleConfig docstring no longer claims idempotence.
Calendar suites: 35 passed (32 prior + 3 new). Lint: 0 errors; complexity
warnings in deploy.js pre-exist at base (61 vs 68 now — the hook did not
worsen the trend line materially; calendar files themselves lint clean).
- __tests__/e2e-node/composition-root.e2e.test.js: `boot()` takes {timeoutMs, code}
and the timeout rejection carries the child it killed; a NEW test drives the real
timeout against a child that never reports PORT/READY and asserts the OS-observed
SIGKILL on that child (marker e2e-timeout-kill) — the r4 claim is now exercised.
- routes/deploys.js: bridge() coerces any non-object JSON body (null/[]/string) into
the same failure shape as a non-JSON body, so no `body.ok` deref can 500 or report a
false success; the subdomain label regex rejects leading AND trailing hyphens.
- __tests__/routes/deploys.catalog.r4.test.js: trailing-dash rejection case + three
malformed-successful-body cases (clean 502, never 500).
The e2e child now calls app.listen(0) and reports the OS-assigned port on
stdout (PORT:<n>); the parent reads it. The probe-then-release helper is
deleted, so no other process can take the port between probe and bind.
BLOCK0: catalog deploy audit now uses the REAL AuditLogger contract
(auditLogger.log({action,resource,details,outcome,ip})) fire-and-forget
via Promise.resolve().catch — async audit failures can never fail the
deploy response (tested with a throwing audit backend).
BLOCK1: verify.sh targeted-jest block captures jest exit code explicitly
(set +e / rc / loud FAIL) — no silent termination under set -e.
BLOCK2: subdomain advertised by the App Selector modal is now FORWARDED
end-to-end (selector -> /deploys/catalog/deploy validated charset ->
bridge --subdomain -> CLI CatalogInstallOptions, implemented in
dc-catalog-2 r3); invalid subdomains 400 before the bridge (4 cases).
POLISH: boot-timeout SIGKILLs the child (no leaked process).
New r4 suite: 7 tests (audit shape success/failure, subdomain forward +
4 rejections). Full suite 157 suites / 3519 tests green.
Submit rewired from /api/v1/apps/deploy (Docker chain) to
/api/v1/deploys/catalog/deploy (shipdeck bridge -> OCI systemd service).
Same modal, same fields: port, mediaPath, plex claim token (sent as env).
No new UI screens. Docker chain no longer called from the selector.
Judge r2 blockers addressed:
- MOUNTED vs UNKNOWN: probes now carry a REAL JWT minted by the same
authManager the app wires (sub claim; generated in the boot child,
emitted on READY). Every mounted-route assertion is compared against a
live notFoundHandler-404 baseline for a known-nonexistent route on the
same instance — a fall-through can no longer pass as mounted.
- Route-level behavior asserted with real payloads: /catalog/plex 200
must contain plexinc/pms-docker AND {{PORT}}:32400; /security/shield 200
must be success:true.
- OS-assigned ephemeral port (net server listen(0)) replaces the random
30000-49999 guess; boot-timeout cleared on readiness; SIGTERM+SIGKILL
shutdown with bounded wait.
- 7 tests (was 5). Suite: 156 suites / 3512 tests green.
GET /deploys/catalog/apps -> bridge /api/catalog/apps (73 embedded apps,
single source of truth). POST /deploys/catalog/deploy {app,port,env} ->
validated (service-id charset, port 1024-65535, env name/value rules) then
proxied to bridge /api/catalog/deploy which runs the shipdeck CLI catalog
deploy (OCI image -> hardened systemd service; NO Docker daemon). Audited
as deploy.catalog with ok/seconds. 11 table-driven route tests incl.
validation rejections never reaching the bridge + bridge-failure 502 shape.
App Selector submit rewired from /apps/deploy (Docker chain) to
/deploys/catalog/deploy — same modal, same fields (port, mediaPath, plex
claim token as env), no new UI screens. Full suite 3510/3510 (156 suites).
- DC-160: /catalog/:appId read app.image/ports/env/volumes which live under
app.docker.* — every detail response was empty. Now reads docker.* and
surfaces defaultPort/subdomain/healthCheck/mediaMount/claimToken/difficulty/
setupInstructions for the deploy form. List/search use the templates own
category field (old hand-rolled CATEGORY_MAP mis-categorized apps).
- Shield (routes/shield.js + 5-line app.js mount) committed to source after
weeks as prod-only drift; regression test asserts the mount exists.
- New composition-root e2e suite: boots REAL createApp() on an ephemeral
port, probes the historically-broken routes through the REAL mount table
(wizard wiring, shield, catalog detail, deploys bridge) — the class of bug
all 3 P7 dogfood findings belonged to. 5 tests.
- Full suite 3499/3499 (155 suites); table-driven DC-160 test covers all 73
image templates.
readonly BACKUP_DIR (constants) collided with the BACKUP_DIR= tunable, so every
curl|bash run died with 'BACKUP_DIR: readonly variable'. Removed the readonly
constant and resolve the default (/etc/dashcaddy/backups) at end of parse_args;
--backup-dir flag still overrides. Live file + /opt copy patched identically.
Dogfood finding #3: upsertPerson resolved existing records by id only.
The wizard upserts a bootstrap admin AFTER a provider sync has already
created a person for the same Tailscale user (no id passed), so the same
providerUserId was duplicated into two records. Resolve existing by
providerUserId when no id is given; bootstrap Admin group + protectedAt are
preserved on the merge. New regression test; full suite 3414/3414.
Dogfood finding #2: createTailscaleProvider() built with coordClient=null;
nothing in prod ever called attachCoordClient() (the wiring the provider
docblock promised never landed), so wizard credential validation always
failed not_configured even with a valid stored token. Pass a delegating
proxy that fetches a fresh coord client per call via the sanctioned
ctx.tailscaleCoord.getClient pattern (token re-read from credentialManager
each call). Full suite 3413/3413.
Hermes
sami7777