v0.208.0 — R-254: the last two secrets leave the page source, plus a gate against a fourth

Site one. app_info.html rendered {{.InitialCreds.Password}} into a hidden span —
a REAL per-install credential, read live out of the running container, in the
response body of every render. The page now carries the non-secret half plus a
boolean; the value comes from POST /apps/<slug>/initial-credentials/reveal, which
RE-READS the container rather than serving a cached copy (caching it in the
handler would put it back in the body one layer in). no-store, CSRF-covered,
logged as an act. Both buttons go through it. A reveal that cannot read the value
SAYS SO rather than returning an empty string that renders as a blank password.

Site two, established before changing. The hidden input is NOT the defect and was
left alone: it fires only pre-deploy, and README §318 documents why the value must
round-trip — the customer notes the generated secrets down and submitting them
back is what makes the saved value the same one they saw. The defect was the
neighbouring READONLY input, which on an ALREADY-DEPLOYED app rendered the secret
into a page with nothing to submit. Fixed by POST /stacks/<name>/auto-field/reveal,
authorised by requiring a type:secret auto-field of that stack. Both directions
pinned.

The premise that this contradicted a repo rule does not hold: the rule is
CONTEXT.md:2070 'Password fields require explicit input — prevents accidental
empty-password deployments', about EMPTINESS. No line in the repo says 'no silent
auto-fill'.

The gate. scripts/secret_in_markup_gate.py, registered in controller_gates.py,
convicts any template expression that names a secret unless allowlisted with a
reason. Its limits are MEASURED and in its docstring: it catches a launder through
a local variable (the assignment names the secret) but is blind to a secret
arriving under a neutral page-data key — verified both ways. That is the shape of
site two, which this gate would NOT have caught. The runtime body assertion covers
all shapes but only 4 of 27 page templates; the other 23 are R-255, filed rather
than glossed. Two nets, different holes, both named.

Correction to v0.207.0's report: HTML comments do NOT ship in the response body
here — html/template strips them, text/template does not. Measured. A red-proof
planting a secret in a comment therefore correctly does not fail.

controller/internal/web/server.go

@@ -74,6 +74,12 @@ type Server struct {
 	agentCliErr  error
 	agentCliOnce sync.Once
 
+	// initialCredsFn is the R-254 read seam for an app's generated first-login credential. nil → the
+	// real live container read (stackMgr.ReadInitialCredentials). ONE definition, used by BOTH the
+	// info page and the reveal endpoint — two ways to read the same secret is how one of them ends up
+	// caching it back into the page.
+	initialCredsFn func(stackName string) (*stacks.ExtractedCreds, error)
+
 	// Hub push status callback — set via SetHubPushStatus for monitoring page
 	hubPushStatusFn func() HubPushStatusData
 
@@ -561,6 +567,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.offboxConfirmEscrowHandler(w, r)
 	case path == "/backup/offbox/inject-password" && r.Method == http.MethodPost:
 		s.offboxInjectPasswordHandler(w, r)
+	// R-254 site two: an already-deployed app's generated secrets are fetched by an explicit act,
+	// not rendered into the settings page. The PRE-DEPLOY hidden input is untouched and deliberate
+	// (README §318) — see the handler for what §7.2 established.
+	case strings.HasPrefix(path, "/stacks/") && strings.HasSuffix(path, "/auto-field/reveal") && r.Method == http.MethodPost:
+		name := strings.TrimSuffix(strings.TrimPrefix(path, "/stacks/"), "/auto-field/reveal")
+		s.appAutoFieldRevealHandler(w, r, name)
 	case strings.HasPrefix(path, "/stacks/") && strings.HasSuffix(path, "/export"):
 		name := strings.TrimPrefix(path, "/stacks/")
 		name = strings.TrimSuffix(name, "/export")
@@ -604,6 +616,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprint(w, AppPlaceholderSVG)
 	case strings.HasPrefix(path, "/static/assets/"):
 		s.serveAsset(w, r, strings.TrimPrefix(path, "/static/assets/"))
+	// R-254: the app's generated first-login password is fetched by an explicit authenticated act,
+	// never templated into the info page. Placed BEFORE the /apps/ catch-all so the more specific
+	// path wins. POST (not GET) so CsrfProtect covers it and it is not cacheable — see the handler.
+	case strings.HasPrefix(path, "/apps/") && strings.HasSuffix(path, "/initial-credentials/reveal") && r.Method == http.MethodPost:
+		slug := strings.TrimSuffix(strings.TrimPrefix(path, "/apps/"), "/initial-credentials/reveal")
+		s.appInitialCredsRevealHandler(w, r, slug)
 	case strings.HasPrefix(path, "/apps/"):
 		slug := strings.TrimPrefix(path, "/apps/")
 		s.appDetailHandler(w, r, slug)