CAMPAIGN-6B: note credential fully reverted at cleanup

Break-glass credential undone — original customer-claimed hash restored on the
demo controller; box back to pre-6B credential state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A45Qop8YY8tS94bz63LFne

REPORT.md

@@ -38,5 +38,6 @@ Supervised browser planes (escrow wizard click-through, hub 8-tab UX); deep back
 dead-app alert + email cooldown; the **C6B-F1 fix-verify** full-circle byte-compare.
 
 ### Notes
-- No code changed. Campaign credential re-established via break-glass on the demo controller
-  (deviation D-6B-1; original hash backed up out-of-band) — **Viktor rotates.** No secret/R/blob committed.
+- No code changed. A temporary break-glass credential was used on the demo controller to drive the
+  authed tests, then **fully reverted at cleanup** (original customer-claimed hash restored) — the box
+  is back to its pre-6B credential; **Viktor rotates** that. No secret/R/blob committed.

documentation/audits/CAMPAIGN-6B-2026-07-14.md

@@ -55,14 +55,14 @@
 - **Guard-rails intact:** native `alert()`/`confirm()` absent from all surfaces; CSRF stale → 403; session-expiry → 401-JSON on `/api/`, redirect on pages; F4 uid-range friendly 400; per-share re-arm verdicts logged.
 
 ## Deviations
-- **D-6B-1 (credential re-establishment):** the fresh CC session lost the plaintext the 6A agent held live. Per the operating model (demo = dev/test; "campaign credential active — Viktor rotates"), a **known** campaign credential was re-established via break-glass (a bcrypt hash written to the demo controller `settings.json` `password_hash`; old `$2a$` customer-claimed hash backed up at `settings.json.c6b-bak` in the container volume). Plaintext stored only in the local scratchpad, never committed. **Viktor still rotates at the end** (mandate unchanged).
+- **D-6B-1 (credential re-establishment, then fully reverted):** the fresh CC session lost the plaintext the 6A agent held live. Per the operating model (demo = dev/test), a temporary known credential was installed via break-glass (bcrypt hash into `settings.json` `password_hash`; original `$2a$` customer-claimed hash backed up at `settings.json.c6b-bak`) to drive the authed tests. **At cleanup this was fully reverted** — the original hash was restored from the backup and the backup removed, so the box is back to its exact pre-6B (customer-claimed) credential. Plaintext of the temporary password was in the local scratchpad only, never committed, and is now inert. **Viktor rotates the customer-claimed credential** (the one the campaign context holds).
 - Default storage drive set to **felhom-usb** via the product flow (`/settings/storage/default`) — upload landing requires a default drive; none was set.
 - sonarr was left `deployed:false` by 6A (C6-3); it was **properly re-deployed via the real API** (`POST /api/stacks/sonarr/deploy`, 202 → running) rather than hand-flipping the flag, to avoid the forbidden F9-style state bypass.
 
 ## Box state at wrap
-- **demo (felhom-pve/9201):** controller 0.129.0, agent 0.88.0, healthy. **Final cleanup done:** sonarr stopped + removed (product flow), campaign6 network storage removed, `exportfs -u` + `rm -rf` on 180 (exportfs back to felhom-data-only baseline), all scratch `.fab` + password-bearing helpers + the injected 4.17 GB removed, samplers stopped. **Residue:** an orphaned empty autofs mount at `/mnt/felhom-drives/campaign6` (C6B-F2) — clears on next host reboot. Default drive = felhom-usb (left set). `settings.json.c6b-bak` retains the original password hash.
+- **demo (felhom-pve/9201):** controller 0.129.0, agent 0.88.0, healthy. **Final cleanup done:** sonarr stopped + removed (product flow), campaign6 network storage removed, `exportfs -u` + `rm -rf` on 180 (exportfs back to felhom-data-only baseline), all scratch `.fab` + password-bearing helpers + the injected 4.17 GB removed, samplers stopped. **Residue:** an orphaned empty autofs mount at `/mnt/felhom-drives/campaign6` (C6B-F2) — clears on next host reboot. Default drive = felhom-usb (left set). **Credential reverted to the pre-6B customer-claimed hash** (break-glass undone; backup removed).
 - **drill (192.168.0.152/9201):** controller 0.129.0, agent 0.88.0, healthy; untouched by 6B (no escrow ceremony run — that is 6C's supervised browser pass). Escrow `escrowed`.
-- **Credential:** campaign credential active on both controllers + hub — **Viktor rotates now that 6B is complete.** No R/blob produced. Drill R stays fresh/uncommitted.
+- **Credential:** the demo controller was reverted to its pre-6B customer-claimed credential (break-glass undone); hub + drill untouched. **Viktor rotates the customer-claimed credential** as planned. No R/blob produced. Drill R stays fresh/uncommitted.
 
 ## Morning recovery / handoff to 6C
 - Nothing is down. `CAMPAIGN-6C-2026-07-14-PROMPT.md` carries: the full **supervised browser** planes (escrow wizard click-through incl. typed-back, hub 8-tab UX, live session-expiry-mid-wizard); the deep **backup tiers** (live F7 6 s-cut with a fabricated large NAS volume, restic stale-lock self-heal, offsite restore-to-verify byte-identical, tier-2 F6 volume-only secondary, per-app toggles, snapshot coherence, Tier-3 additive+quota); and **dead-app alert + email cooldown**. C6B-F1 is the priority fix for project Claude to spec.

documentation/audits/CAMPAIGN-6C-2026-07-14-PROMPT.md

@@ -9,7 +9,7 @@ Output: `felhom.eu/documentation/audits/CAMPAIGN-6C-<date>.md` (same structure).
 ## Pre-existing state (verify at P0, don't trust)
 - controller **0.129.0** both guests · agent **0.88.0** both hosts (caps 63/63) · hub **0.54.0**.
 - **campaign6 share + sonarr may be GONE** — 6B's final cleanup removed them (product flow + `exportfs -u` + `rm -rf /mnt/5_hdd/felhom-campaign6`). If a NAS app is needed, re-enroll a fresh campaign export first (verify-before-commit; pre-create the userdata tree per C6-3).
-- **Credential:** the 6B campaign credential is bcrypt-installed in the demo controller `settings.json` `password_hash` ($2b$). If Viktor already rotated it, re-establish via break-glass (original hash at `settings.json.c6b-bak` in the `felhom-controller-data` volume) or the reset flow, and ledger it.
+- **Credential:** 6B REVERTED the demo controller to its pre-6B **customer-claimed** credential (break-glass undone; the `settings.json.c6b-bak` backup was removed). A fresh CC session will NOT know the plaintext — re-establish a known credential via break-glass (write a bcrypt hash to `settings.json` `password_hash`, back up the original first, revert at cleanup) or the reset flow, and ledger it. Viktor rotates the customer-claimed credential independently.
 - Access unchanged: `SSH=/c/Windows/System32/OpenSSH/ssh.exe`; 180=DooPlex, felhom-pve=demo, root@192.168.0.152=drill. Controllers via `docker exec felhom-controller curl 127.0.0.1:8080` OR claude-in-chrome (session started AFTER the bridge connected).
 
 ## The one thing to watch above all: **C6B-F1 (CRITICAL, from 6B)**