CC secrets STOP 3: R-1119, R-1120, R-1131, R-1132 closed (181 -> 177); R-1130/R-1133/R-1134 facts; new keys proven; report

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/audits/cc-creds-build-2026-10-17/docker-login-test.txt

@@ -0,0 +1,13 @@
+registry=docker.io (Docker Hub) rc=0: Login Succeeded
+registry=gitea.dooplex.hu rc=1: Error response from daemon: Get "https://gitea.dooplex.hu/v2/": unauthorized
+{
+  "auths": [
+    "gitea.dooplex.hu",
+    "https://index.docker.io/v1/"
+  ],
+  "credsStore": null,
+  "credHelpers": []
+}
+gitea.dooplex.hu: user is 5 chars, password length 32, sha256 eeb25e1e
+https://index.docker.io/v1/: user is 8 chars, password length 36, sha256 f0e3866b
+DOCKER_PASSWORD: length 36, sha256 f0e3866b

documentation/audits/cc-creds-build-2026-10-17/facebook-read.txt

@@ -0,0 +1,2 @@
+key FACEBOOK_API: 201 chars, starts EAA, from environment (sec run)
+read: done

documentation/audits/cc-creds-build-2026-10-17/harness/line20hash.py

@@ -0,0 +1,4 @@
+# Hash-only comparison the operator asked for (STOP 3 d). Prints a length and an 8-hex prefix, never the value.
+import hashlib, os
+l = open(os.path.expanduser("~/.config/credentials"), encoding="utf-8").read().split("\n")[19].strip()
+print("line 20: length %d, sha256 %s" % (len(l), hashlib.sha256(l.encode()).hexdigest()[:8]))

documentation/audits/cc-creds-build-2026-10-17/harness/tuya_status.py

@@ -0,0 +1,10 @@
+# Read-only Tuya cloud status per plug, keys from `sec run` env. Prints success, item count and switch state only.
+import os, tinytuya
+c = tinytuya.Cloud(apiRegion="eu", apiKey=os.environ["TUYA_ID"], apiSecret=os.environ["TUYA_SECRET"])
+print("cloud token:", "ok" if getattr(c, "token", None) else "FAILED (%s)" % getattr(c, "error", "?"))
+for name in ("TUYA_DEVICE_ID_N100", "TUYA_DEVICE_ID_HP"):
+    r = c.getstatus(os.environ[name])
+    ok = isinstance(r, dict) and r.get("success") is True
+    items = r.get("result", []) if ok else []
+    sw = [i.get("value") for i in items if i.get("code") == "switch_1"]
+    print("%s: %s, %d status items, switch_1=%s" % (name, "PASS" if ok else "FAIL code=%s msg=%s" % (r.get("code"), r.get("msg")) if isinstance(r, dict) else "FAIL", len(items), sw[0] if sw else "?"))

documentation/audits/cc-creds-build-2026-10-17/homelab-ask-pattern-test.txt

@@ -0,0 +1,4 @@
+kubectl get secret -n spike-none -o yaml | denials=1 | ccsec-hook-lines=0 | result: Denied: the Bash command didn't run, because the permission wasn't granted.
+kubectl get secrets -n spike-none -ojson | denials=1 | ccsec-hook-lines=0 | result: Denied: the Bash command didn't run because permission wasn't granted.
+kubectl get secret x -n spike-none --output=yaml | denials=1 | ccsec-hook-lines=0 | result: Denied: the command did not run, because permission to use Bash wasn't granted.
+kubectl get secret -n spike-none | denials=0 | ccsec-hook-lines=0 | result: It ran but failed. The command wasn't blocked, but kubectl couldn't read `/etc/rancher/k3s

documentation/audits/cc-creds-build-2026-10-17/line20-compare.txt

@@ -0,0 +1,2 @@
+line 20: length 32, sha256 5a85c86f
+TUYA_SECRET: length 32, sha256 eae4f0ba

documentation/audits/cc-creds-build-2026-10-17/new-keys-check.txt

@@ -0,0 +1,5 @@
+FACEBOOK_API: length 201, sha256 7767f7a2
+TUYA_ID: length 20, sha256 327df7cc
+TUYA_SECRET: length 32, sha256 eae4f0ba
+TUYA_DEVICE_ID_N100: length 22, sha256 f7620de0
+TUYA_DEVICE_ID_HP: length 22, sha256 f58eb615

documentation/audits/cc-creds-build-2026-10-17/redproof.txt

@@ -14,6 +14,10 @@ RED    hook: the masked key is not named                       -> FAILED (failur
 RED    hook: a persisted-only hit is not named                 -> FAILED (errors=1)      restored=True
 RED    store: plain names masked anyway                        -> FAILED (failures=1)    restored=True
 RED    store: plain list is an off switch                      -> FAILED (errors=1)      restored=True
+RED    rules: substitutions not looked into                    -> FAILED (failures=4)    restored=True
+RED    rules: substitutions skipped under sec run              -> FAILED (failures=1)    restored=True
+RED    rules: unparseable risky command passes                 -> FAILED (failures=5)    restored=True
+RED    rules: a leading sec run exempts every segment          -> FAILED (failures=3)    restored=True
 RED    install: foreign hooks dropped                          -> FAILED (failures=1)    restored=True
 RED    install: malformed settings overwritten                 -> FAILED (failures=1)    restored=True
 after all restores, full suite: OK

documentation/audits/cc-creds-build-2026-10-17/tuya-status.txt

@@ -0,0 +1,3 @@
+cloud token: ok
+TUYA_DEVICE_ID_N100: PASS, 18 status items, switch_1=True
+TUYA_DEVICE_ID_HP: PASS, 18 status items, switch_1=True