jposluns · Oct 19, 2026 · Oct 19, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- `authentication.md`: the fail2ban rule now cites fail2ban 1.1.1's shipped `sshd`, `nginx-http-auth` and `webmin-auth` filters and jails, which are disabled by default; enabling the relevant jails with matching log paths is labelled as this guide's advice, and coverage of any particular login panel and how easy it is to set up are stated as not established; TODO row 1.293 moves to DONE (#694)
 - `authentication.md`: the Cloudflare Access rule now cites Cloudflare's One-time PIN, identity-provider and generic OIDC pages for the login options, and its existing self-hosted web application scope now reads "published through Access", stating that use with any application unchanged is not established; no command changes; TODO row 1.292 moves to DONE (#692)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header and components listed headline tools first; no guide body or digest changes. Guides: `llm-observability.md`, `agent-builders.md`, `ai-infra-services.md`, `vector-databases.md`, `search-engines.md`, `elasticsearch.md`, `minio.md`, `object-storage.md`, `jupyter.md`, `gradio.md`, `streamlit.md`, `code-server.md`, `n8n.md`, `headless-browser-services.md`, `headless-cms-instant-api.md`, `supabase-self-hosted.md`, `observability-components.md`, `self-hosted-error-trackers.md`, `realtime-webhooks.md`, `realtime-voice-infra.md` (#691)
 - `pocketbase.md`: the source-limits are traced: PocketBase v0.40.4's root command wrapper and the `--dev` flag (its default and what it changes), and in Appwrite 2.2.0 how a document read is checked against collection and document permissions and how requests are classified as privileged or API-key authenticated, as far as the Appwrite repository shows; matching roles against stored permissions inside the `utopia-php/database` dependency stays open under TODO row 1.291; one previously exempt table row is now marked, so its Verify-marking exemption is removed (#690)

diff --git a/DONE.md b/DONE.md
@@ -10,6 +10,7 @@ because an item that simply vanishes gets proposed again six months later.
 
 | ID | Item | Ended |
 | --- | --- | --- |
+| 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. |
 | 1.292 | `authentication.md`: cloudflare-access: source or narrow the claim that Cloudflare Access can front any application unchanged, including the One-time PIN and SSO options still not established by the cited pages. (M, M) | Done, #692. Cited the pinned one-time PIN, identity-provider options and generic OIDC pages for the login methods, narrowed the fronting statement to a self-hosted web application published through Access, and labelled unchanged any-application use as not established and this guide's assessment. |
 | 1.291 | `pocketbase.md`: source-limits: trace the PocketBase CLI wrapper and Appwrite document read authorization and privileged/API-key requester classification; establish the `--dev` default. (M, M) | Done, #690. Pinned the PocketBase v0.40.4 wrapper wiring, the `--dev` default (disabled unless probably started with go run) and its dev-mode logging effects, and the Appwrite 2.2.0 keys/privileged requester classification, API-key and admin-mode authorization-status handling, route scope validation and document-read call sites; the utopia-php/database role-to-permission enforcement stays open in TODO.md under the same ID. |
 | 1.290 | `firebase-supabase.md`: local-guards: cite the recorded ShellCheck release. (M, M) | Done, #689. Cited the ShellCheck v0.11.0 changelog for the release named in the historical runs without attesting to the host binary; unrecorded bash and other tool/parser versions remain open in TODO.md under 1.290. |

diff --git a/TODO.md b/TODO.md
@@ -60,7 +60,6 @@ A real surface the guide never covers. Correct as far as it goes, and not far en
 | 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | `[gap]` |
 | 1.290 | `firebase-supabase.md`: local-guards: establish the unrecorded bash and other tool/parser versions for the historical authoring guard and syntax runs; the ShellCheck v0.11.0 release is cited, but does not attest to the historical host binary. (M, M) | `[gap]` |
 | 1.291 | `pocketbase.md`: source-limits, remaining dependency gap: trace how utopia-php/database matches requester roles against stored collection/document permissions (including documentSecurity) for document reads and what the disabled default authorization status bypasses; the Appwrite-repository call sites, PocketBase CLI wrapper and `--dev` default are cited. (M, M) | `[gap]` |
-| 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | `[gap]` |
 | 1.294 | `authentication.md`: transport-authentication: source or narrow the HTML-login boundary for non-HTTP transports, GraphQL/inference/management APIs and webhook replay rejection. (M, M) | `[gap]` |
 | 1.295 | `authentication.md`: verify-secret-scan: source or narrow staged, all-ref and merge-commit coverage beyond the cited Gitleaks and `git log -p` material. (M, M) | `[gap]` |
 | 1.296 | `docker.md`: secrets: source runtime secret-delivery methods and `.env` exclusion from Git beyond the cited Docker build/history behaviour. (M, M) | `[gap]` |

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.0.692
+1.0.694