R-1133 closed as accepted (option A): ~/.docker/config.json joins the guard's read-refusal list (cc-secrets 0.2.2); 174 rows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/audits/cc-creds-build-2026-10-17/redproof.txt

@@ -21,6 +21,7 @@ RED    rules: a leading sec run exempts every segment          -> FAILED (failur
 RED    rules: the child of sec run is not checked              -> FAILED (failures=7)    restored=True
 RED    rules: option B not applied                             -> FAILED (failures=5)    restored=True
 RED    run: unloaded stored names reach the child              -> FAILED (failures=1)    restored=True
+RED    rules: docker config not protected                      -> FAILED (failures=4, errors=1) restored=True
 RED    install: foreign hooks dropped                          -> FAILED (failures=1)    restored=True
 RED    install: malformed settings overwritten                 -> FAILED (failures=1)    restored=True
 after all restores, full suite: OK

documentation/backlog/CLOSED-ITEMS.md

@@ -46,6 +46,7 @@
 | **R-1130** | **`DOCKER_PASSWORD` (the Docker Hub password; Gitea refuses it) is in one old CC session record (2026-09-21).** (P3) | CLOSED 2026-10-17 — ACCEPTED by the operator (D15 „keep"): no rotation. Facts measured first: Docker Hub login succeeded, `gitea.dooplex.hu` 401, `~/.docker/config.json` saves the same Hub login. | `audits/cc-creds-build-2026-10-17/docker-login-test.txt` |
 | **R-1134** | **Retire the old `~/.config/credentials`.** (P3) | CLOSED 2026-10-17 — DELETED (`shred -u`) on the operator's go, after an in-memory check that all 23 keys in it equal the store (0 problems). Its nameless line 20 was a separator between the Felhom and JARR passwords; the operator removed it first. Two older backup copies found beside it → R-1138. | `audits/cc-creds-build-2026-10-17/old-file-compare.txt` |
 | **R-1138** | **Three old plain copies of the deleted credentials file were left in `~/.config/`.** (P3) | CLOSED 2026-10-17 — all three shredded on the operator's word (`.bak-20261001-calibre`, `.bak-20261016-tester1`, then the undated `.bak`); each was compared in memory first: every key equal to the store except one older value each. A final search of `~` (depth 4) finds no `credentials` file outside `~/.claude`. | `audits/cc-creds-build-2026-10-17/old-backups-compare.txt` |
+| **R-1133** | **`~/.git-credentials` and `~/.docker/config.json` on DooPlex hold Gitea and registry logins in clear text (base64 for Docker).** (P3) | CLOSED 2026-10-17 — ACCEPTED, operator option A: both files stay (git and docker must read them), and the guard refuses reads of both — `~/.docker/config.json` added in cc-secrets 0.2.2 (test red first, red-proof 26/26; live: `head -c 0 ~/.docker/config.json` refused). | cc-secrets `48e05c3` |
 
 ## 2026-10-17 — Tester 1 on the live catalog, decoy suites in every runner, memory limits, FileBrowser (controller v0.326.0, catalog `bff82f9`)
 

documentation/backlog/OPEN-ITEMS.md

@@ -211,7 +211,7 @@ stopping line that lies.
 | **R-1094** | Storage & devices | P4 | **The whole-disk format refusal tells the household to format the free part — which is refused while the other part is in use.** SEEN 2026-10-16 (controller 0.318.0): 409 „Ezen a lemezen egy használatban lévő meghajtó van, ezért a teljes lemez nem formázható. Csak a szabad részét formázhatod." — since agent 0.158.1 a part next to a mounted part can only be USED (the root wrapper trusts no „Felhom's own" claim). Evidence: `audits/storage-identity-buildB-2026-10-15/live/14-samedisk-refusal-offer.txt`. | READY | — | Reword `err.web.meghajto_hasznalatban_formazas` (hu + en): „… nem formázható. A szabad részét használatba veheted." Next controller release; the copy gates run. | CC |
 | **R-1124** | Storage & devices | P4 | **A drive decommissioned and then unplugged keeps its agent mount unit enabled on the host** (`mnt-<name>.mount`, „Managed by felhom-agent”, `WantedBy=multi-user.target`), so every later boot waits for a device that is gone, and the agent's watchdog reports it „disconnected”. Decommission retires the drive logically (agent: „logical retire, data untouched”) and releases only the guest bind; no product path releases the host mount or forgets the drive. Seen on Tester 1 at the R-1022 teardown 2026-10-17 (four units left; the boot delay is read from the unit, NOT measured). | OPEN — filed 2026-10-17 **2026-10-17 (later):** on Tester 1 the four units were disabled and removed by hand (read before and after, `audits/filebrowser-memory-ci-2026-10-17/P4/`); the agent did not write them back, but it still lists the four drives and logs „enrolled drive absent by UUID — will retry” every ~20 s. The product fix (decommission releases the host mount and lets the agent forget an absent drive) is an agent change — it waits for the next vouched agent release. | — | Decide „forget a decommissioned drive” (unit disabled + removed when the drive is absent), with a test | CC |
 
-## Security & access — 20 rows (P1 1, P2 2, P3 11, P4 6)
+## Security & access — 19 rows (P1 1, P2 2, P3 10, P4 6)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
@@ -234,7 +234,6 @@ stopping line that lies.
 | **R-1054** | Security & access | P3 | **The hub's operator/global API key is still one bearer that can do everything on `/api/v1`, including reading every box's break-glass root password (`GET /admin/hosts/{id}/recovery-credential`).** Hub v0.152.0 gave the web surface scoped tokens (`05` §17) but tokens are refused on `/api/v1` by design. Who uses the global key today is not listed in one place. Fix: list its consumers; move each operator use to a scoped token on the web side (or a token class on the API), and keep the global key only where a box path needs it — or retire it. | OPEN — filed 2026-10-15 by the token build | — | List the global key's consumers (pod env, scripts, runbooks) | CC |
 | **R-1118** | Security & access | P3 | **CC's secrets moved off the plain `~/.config/credentials` into an encrypted store with a broker and guards; what is left is retiring the old file.** BUILT 2026-10-17 (store B, operator ruling 11:28): private repo `admin/cc-secrets` (`ARCHITECTURE.md`, the design verbatim in `docs/`), `sec` (no get), PreToolUse refusals + PostToolUse masking for Bash and Read in `~/.claude/settings.json` (every CC session on DooPlex), nightly transcript sweep with mail. 55 tests, 18 red-proofs, 36-row child-session proof in both launch modes, fresh-session proof (`audits/cc-creds-build-2026-10-17/`). 25 names in the store (23 imported, `RESEND_API` from CC's environment, a self-test value). `12-agent-tooling.md` §5 points at it. | NARROWED — built; the old file's retirement is R-1134 | the week with no reader (R-1134) | `sec doctor` stays all OK; R-1134 | CC |
 | **R-1121** | Security & access | P3 | **`~/rotated-secrets-2026-10-09.txt` still exists on DooPlex** — 632 bytes, modified 2026-10-09 13:08 +0200, mode 600 (SPIKE Q6: `test -e` + `stat` only, not opened). Left by the R-925 rotation work. If any value in it is still valid, it is one more plaintext secrets file in the home folder, readable by every CC session. | WAITING-ON-OPERATOR | what the file holds — only the operator knows | Operator: confirm every value in it is revoked, then `shred -u` it; or move the live ones into the R-1118 store | operator |
-| **R-1133** | Security & access | P3 | **`~/.git-credentials` on DooPlex holds Gitea tokens in clear text** — three entries (`kisfenyo`, `Kisfenyo`, `admin`); the `admin` token has `write:repository` (and misc, package, issue, notification). Any `cat` of it prints them; the new PreToolUse guard refuses reads of that path (`read-secret-file`), but git itself must keep reading it. Out of the 2026-10-17 build's scope by its brief. **Same class:** `~/.docker/config.json` holds two saved registry logins (Docker Hub, `gitea.dooplex.hu`) as base64 — R-1130; the guard does not list that path yet. | OPEN | — | Decide: move git to a credential helper that reads from `sec`, or accept the file (0600) with the guard | operator → CC |
 
 ## Box system & updates — 12 rows (P2 1, P3 7, P4 4)