CC uses its hub token: live C3 proof (floor no-op 303 floor_set, vouch 403, session-only 403); R-1051 closed; skill floor step + prune script on the token; STATUS: change the hub password

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/05-hub-architecture.md

@@ -464,7 +464,7 @@ cannot add a custom header without a CORS preflight, which the hub never answers
 the route switch, so it covers every route at once (38 state-changing routes + an unknown path in
 `r135_csrf_test.go`); `/login` and the public `/bind/<token>` stay exempt (no operator session to ride; the bind token
 is the capability). The other choice — dropping browser-usable Basic auth entirely — was not taken: CC's headless runs
-and the runbooks drive the hub with Basic auth, and the header costs them one flag.
+and the runbooks drive the hub with Basic auth, and the header costs them one flag. *Since v0.152.0 CC's scripts use a scoped token instead (§17); Basic stays for the operator's own scripts.*
 
 ### 16.2 Secrets at rest in `hub.db` (R-133, R-821)