CC secrets STOP 3: R-1119, R-1120, R-1131, R-1132 closed (181 -> 177); R-1130/R-1133/R-1134 facts; new keys proven; report

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/backlog/CLOSED-ITEMS.md

@@ -39,6 +39,10 @@
 | Row | What | Closed | Evidence |
 |---|---|---|---|
 | **R-1122** | **`skills/felhom-build-deploy/SKILL.md` told CC to `source ~/.config/credentials` for the ISO publish.** (P3) | CLOSED 2026-10-17 — the ISO publish and the hub-token recipe go through `sec run`; the values reach docker as `-e NAME` and curl through a header file, never on a command line. Both recipes proven: a local server saw the token's hash and length; a read-only `lsf R2:felhom-iso` listed the bucket. | `ba40c0a2`; `audits/cc-creds-build-2026-10-17/` |
+| **R-1119** | **`RESEND_API` was exported into CC's environment from `~/.bashrc` (line 88).** (P3) | CLOSED 2026-10-17 — operator yes (STOP 3 a). Readers searched first (crontab, root crontab, `/etc/cron*`, `/etc/systemd`, `/opt`, `~/bin` (absent), `~/.profile`, `~/.config`, `/usr/local/bin`, `/etc/profile.d`; controls: the same grep found line 88): only a comment in `manifests/contact-mailer.yaml` names it. Line 88 is now a comment pointing at `sec run RESEND_API`; a new interactive shell has no `RESEND_API`. Sessions already running keep it until they restart. No backup of the line was kept (it would be one more plain copy). | `audits/cc-creds-build-2026-10-17/`; REPORT-cc-creds-build |
+| **R-1120** | **`homelab-manifests/.claude/settings.json` allowed `kubectl get secret -o yaml` with no prompt.** (P3) | CLOSED 2026-10-17 — operator yes (STOP 3 b). Three `ask` rules (`kubectl get secret* -o*`, `*--output*`, `*--template*`) in homelab-manifests `9f582ad`. Proven in headless child sessions with only these permission rules: `-o yaml`, `-ojson`, `--output=yaml` held, the plain table ran. Second layer: the user-level guard. | `audits/cc-creds-build-2026-10-17/homelab-ask-pattern-test.txt` |
+| **R-1131** | **demo-felhom's recovery code was printed into the JARR session's record (2026-10-17 08:27 UTC, `. ~/.config/credentials`).** (P3) | CLOSED 2026-10-17 — ACCEPTED by the operator (STOP 3 c): a test box, no rotation. The command shape is refused by the guard since 13:14. | `audits/cc-creds-build-2026-10-17/history-sweep-list.txt` |
+| **R-1132** | **demo-hp's recovery code was printed in the same record line as R-1131.** (P3) | CLOSED 2026-10-17 — ACCEPTED by the operator (STOP 3 c): a test box, no rotation. | as R-1131 |
 
 ## 2026-10-17 — Tester 1 on the live catalog, decoy suites in every runner, memory limits, FileBrowser (controller v0.326.0, catalog `bff82f9`)
 

documentation/backlog/OPEN-ITEMS.md

@@ -211,7 +211,7 @@ stopping line that lies.
 | **R-1094** | Storage & devices | P4 | **The whole-disk format refusal tells the household to format the free part — which is refused while the other part is in use.** SEEN 2026-10-16 (controller 0.318.0): 409 „Ezen a lemezen egy használatban lévő meghajtó van, ezért a teljes lemez nem formázható. Csak a szabad részét formázhatod." — since agent 0.158.1 a part next to a mounted part can only be USED (the root wrapper trusts no „Felhom's own" claim). Evidence: `audits/storage-identity-buildB-2026-10-15/live/14-samedisk-refusal-offer.txt`. | READY | — | Reword `err.web.meghajto_hasznalatban_formazas` (hu + en): „… nem formázható. A szabad részét használatba veheted." Next controller release; the copy gates run. | CC |
 | **R-1124** | Storage & devices | P4 | **A drive decommissioned and then unplugged keeps its agent mount unit enabled on the host** (`mnt-<name>.mount`, „Managed by felhom-agent”, `WantedBy=multi-user.target`), so every later boot waits for a device that is gone, and the agent's watchdog reports it „disconnected”. Decommission retires the drive logically (agent: „logical retire, data untouched”) and releases only the guest bind; no product path releases the host mount or forgets the drive. Seen on Tester 1 at the R-1022 teardown 2026-10-17 (four units left; the boot delay is read from the unit, NOT measured). | OPEN — filed 2026-10-17 **2026-10-17 (later):** on Tester 1 the four units were disabled and removed by hand (read before and after, `audits/filebrowser-memory-ci-2026-10-17/P4/`); the agent did not write them back, but it still lists the four drives and logs „enrolled drive absent by UUID — will retry” every ~20 s. The product fix (decommission releases the host mount and lets the agent forget an absent drive) is an agent change — it waits for the next vouched agent release. | — | Decide „forget a decommissioned drive” (unit disabled + removed when the drive is absent), with a test | CC |
 
-## Security & access — 26 rows (P1 1, P2 2, P3 17, P4 6)
+## Security & access — 22 rows (P1 1, P2 2, P3 13, P4 6)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
@@ -233,14 +233,10 @@ stopping line that lies.
 | **R-1050** | Security & access | P4 | **Raise HSTS to one year on or after 2026-11-15, if no https trouble was reported.** `09` §3 decision 249 (D2 = A, operator 2026-10-15): HSTS stays `max-age=86400` now; after a month with no https trouble it becomes one year (`31536000`); never preload, never `includeSubDomains`. The value is `HSTSMaxAgeSeconds` in `felhom-controller/controller/internal/infra/infra.go`, pinned by `TestRenderForwardedHeaders_HTTPSOnly`. „Trouble” = any report of a name that will not open, or a box answering http after the floor. | **WATCHING** — filed 2026-10-15 | the date | On or after 2026-11-15: read the register and the operator's mail for https trouble since 2026-10-15; none → a controller release with one year (test updated), bake → vouch → floor | CC |
 | **R-1054** | Security & access | P3 | **The hub's operator/global API key is still one bearer that can do everything on `/api/v1`, including reading every box's break-glass root password (`GET /admin/hosts/{id}/recovery-credential`).** Hub v0.152.0 gave the web surface scoped tokens (`05` §17) but tokens are refused on `/api/v1` by design. Who uses the global key today is not listed in one place. Fix: list its consumers; move each operator use to a scoped token on the web side (or a token class on the API), and keep the global key only where a box path needs it — or retire it. | OPEN — filed 2026-10-15 by the token build | — | List the global key's consumers (pod env, scripts, runbooks) | CC |
 | **R-1118** | Security & access | P3 | **CC's secrets moved off the plain `~/.config/credentials` into an encrypted store with a broker and guards; what is left is retiring the old file.** BUILT 2026-10-17 (store B, operator ruling 11:28): private repo `admin/cc-secrets` (`ARCHITECTURE.md`, the design verbatim in `docs/`), `sec` (no get), PreToolUse refusals + PostToolUse masking for Bash and Read in `~/.claude/settings.json` (every CC session on DooPlex), nightly transcript sweep with mail. 55 tests, 18 red-proofs, 36-row child-session proof in both launch modes, fresh-session proof (`audits/cc-creds-build-2026-10-17/`). 25 names in the store (23 imported, `RESEND_API` from CC's environment, a self-test value). `12-agent-tooling.md` §5 points at it. | NARROWED — built; the old file's retirement is R-1134 | the week with no reader (R-1134) | `sec doctor` stays all OK; R-1134 | CC |
-| **R-1119** | Security & access | P3 | **`RESEND_API` is exported into CC's own environment from `~/.bashrc` (line 88), so every Bash call CC makes carries it, and a plain `printenv`, `env` or `set` prints it into the transcript.** MEASURED 2026-10-17 (SPIKE Q6, names only): present in the parent `claude` process environment and in the Bash tool environment. | OPEN | R-1118's broker, for the clean fix (the value lives in the store and reaches only the command that names it) | Until then: find what reads it (memory: the Resend checks run it via `bash -ic`), then move the export out of `~/.bashrc` into that one script — the operator's shell file, so the operator's word | operator |
-| **R-1120** | Security & access | P3 | **`homelab-manifests/.claude/settings.json` allows `Bash(kubectl get:*)` without a prompt, and that pattern includes `kubectl get secret -o yaml`, which prints every value (base64) into the transcript.** Read 2026-10-17 at `origin/main` `e8e595a`, line 6; nothing in the file asks for Secret reads to skip the prompt. The local clone `~/git/homelab-manifests` is behind origin and has uncommitted edits to that same file (not touched). | OPEN | — | Add `Bash(kubectl get secret:*)` and `Bash(kubectl get secrets:*)` to `ask` (ask wins over allow), or a PreToolUse refusal like the spike's `kubectl-read-secret` rule. A permission change, so the operator's word (`.claude/rules/unprompted-work.md` §5) | operator |
 | **R-1121** | Security & access | P3 | **`~/rotated-secrets-2026-10-09.txt` still exists on DooPlex** — 632 bytes, modified 2026-10-09 13:08 +0200, mode 600 (SPIKE Q6: `test -e` + `stat` only, not opened). Left by the R-925 rotation work. If any value in it is still valid, it is one more plaintext secrets file in the home folder, readable by every CC session. | WAITING-ON-OPERATOR | what the file holds — only the operator knows | Operator: confirm every value in it is revoked, then `shred -u` it; or move the live ones into the R-1118 store | operator |
-| **R-1130** | Security & access | P3 | **`DOCKER_PASSWORD` (the Gitea registry login CC uses) is in one old CC session record** — a helper-agent transcript of 2026-09-21 (`~/.claude/projects/-mnt-5-hdd-felhom-eu-git/5f83c0fb…/subagents/agent-a8614eb6ee2a17e6c.jsonl`). Found by the first history sweep 2026-10-17 (`audits/cc-creds-build-2026-10-17/history-sweep-list.txt`; names only). The record has reached Anthropic's API; the value is still valid unless changed. | WAITING-ON-OPERATOR | the operator rotates it, or tells CC to (file → store with `sec put`) | Rotate the registry password; `sec put DOCKER_PASSWORD --from-file F`; check an image pull | operator |
-| **R-1131** | Security & access | P3 | **demo-felhom's recovery code (`R_DEMO_FELHOM`) was printed into the JARR session's record today, 2026-10-17 08:27 UTC**, by `set -a; . ~/.config/credentials` — the Campaign 11 §7 shape (a hyphenated key bash cannot assign, so bash prints the line). This was 3 h before the guards were installed; that command is refused now (`source-secret-file`). Record: `~/.claude/projects/-home-kisfenyo-git-jarr/c9d98cda….jsonl` line 2855 (a tool result). | WAITING-ON-OPERATOR | the operator: re-issue the code, or accept (a demo box) | Decide: re-issue demo-felhom's recovery code, or accept and close | operator |
-| **R-1132** | Security & access | P3 | **demo-hp's recovery code (`R_DEMO_HP`) was printed in the same JARR record line as R-1131** (2026-10-17 08:27 UTC, the same `. ~/.config/credentials`). | WAITING-ON-OPERATOR | the operator: re-issue, or accept (a demo box) | Decide together with R-1131 | operator |
-| **R-1133** | Security & access | P3 | **`~/.git-credentials` on DooPlex holds Gitea tokens in clear text** — three entries (`kisfenyo`, `Kisfenyo`, `admin`); the `admin` token has `write:repository` (and misc, package, issue, notification). Any `cat` of it prints them; the new PreToolUse guard refuses reads of that path (`read-secret-file`), but git itself must keep reading it. Out of the 2026-10-17 build's scope by its brief. | OPEN | — | Decide: move git to a credential helper that reads from `sec`, or accept the file (0600) with the guard | operator → CC |
-| **R-1134** | Security & access | P3 | **Retire the old `~/.config/credentials`**: every named key is in the CC store since 2026-10-17 13:16 (23 imported; the two hyphenated names became `R_DEMO_FELHOM`, `R_DEMO_HP`). **Two open points:** (1) its line 20 is a 32-character value with NO name — the import refused it (one bad line refuses all) and CC imported the named lines from a filtered copy; only the operator knows what it is. (2) `FACEBOOK_API` and the Tuya keys, which `fb_probe.py` and the bench README name, are in neither the file nor the store. | WAITING-ON-OPERATOR | a week with no reader (from 2026-10-17), and the operator's go | 2026-10-24: check no reader (sweep + `hook.log`); operator names line 20 (or drops it); then rename the file to `.retired`, and delete only on the operator's go | operator → CC |
+| **R-1130** | Security & access | P3 | **`DOCKER_PASSWORD` is the Docker Hub password of the account `DOCKER_USERNAME`, and it is in one old CC session record** (a helper-agent transcript of 2026-09-21, `~/.claude/projects/-mnt-5-hdd-felhom-eu-git/5f83c0fb…/subagents/agent-a8614eb6ee2a17e6c.jsonl`; first history sweep 2026-10-17). **What it opens, measured 2026-10-17** with a throwaway `DOCKER_CONFIG` (nothing saved): Docker Hub `Login Succeeded`; `gitea.dooplex.hu` **401** (as on 2026-10-08 and 10-10). `~/.docker/config.json` (0600) holds saved logins for Docker Hub — the SAME password (sha256 prefix equal) — and for `gitea.dooplex.hu` (a different 32-character password, 5-character user). Evidence `audits/cc-creds-build-2026-10-17/docker-login-test.txt`. Nothing rotated. | WAITING-ON-OPERATOR | the operator's decision after these facts | Operator: rotate the Docker Hub password or accept; if rotated, `sec put DOCKER_PASSWORD --from-file F` and re-login the saved config | operator |
+| **R-1133** | Security & access | P3 | **`~/.git-credentials` on DooPlex holds Gitea tokens in clear text** — three entries (`kisfenyo`, `Kisfenyo`, `admin`); the `admin` token has `write:repository` (and misc, package, issue, notification). Any `cat` of it prints them; the new PreToolUse guard refuses reads of that path (`read-secret-file`), but git itself must keep reading it. Out of the 2026-10-17 build's scope by its brief. **Same class:** `~/.docker/config.json` holds two saved registry logins (Docker Hub, `gitea.dooplex.hu`) as base64 — R-1130; the guard does not list that path yet. | OPEN | — | Decide: move git to a credential helper that reads from `sec`, or accept the file (0600) with the guard | operator → CC |
+| **R-1134** | Security & access | P3 | **Retire the old `~/.config/credentials`**: every named key is in the CC store since 2026-10-17 13:16 (23 imported; the hyphenated names became `R_DEMO_FELHOM`, `R_DEMO_HP`). The operator added `FACEBOOK_API`, `TUYA_ID`, `TUYA_SECRET`, `TUYA_DEVICE_ID_N100`, `TUYA_DEVICE_ID_HP` to the store the same day; each passed a real read-only call through `sec run` (fb_probe `read`: page, feed, insights ok, token „from environment (sec run)"; Tuya cloud status: both plugs `success`, 18 items). **Open:** its line 20 is a 32-character value with NO name — its sha256 prefix matches NO stored value (`TUYA_SECRET` included; `audits/cc-creds-build-2026-10-17/line20-compare.txt`), so the operator names it. | WAITING-ON-OPERATOR | the operator names line 20; a week with no reader (from 2026-10-17) | 2026-10-24: check no reader (sweep + `hook.log`); then rename the file to `.retired`; delete only on the operator's go | operator → CC |
 
 ## Box system & updates — 12 rows (P2 1, P3 7, P4 4)