admin daf942fc7a security review part 4: 18 finding rows (R-970..R-987), notes on R-935/R-132/R-908, the rotation date in secrets.md (101 -> 119 rows)

2026-10-12 17:10:19 +02:00

..

break-glass-sheet.md

dooplex-offsite: the operator signing keys ride the nightly encrypted copy; restore test proves each key matches its public half (R-924, operator ruling option A)

2026-10-09 14:49:08 +02:00

break-glass.md

…

config-bundle.md

…

crash-guard.md

…

day0-install.md

answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

2026-10-12 14:07:50 +02:00

dooplex-remove-disk-Z6A07P2G.md

evening Part A: disk Z6A07P2G silenced 30 days by serial, Longhorn HDD4 removed, removal checklist + R-934; R-231 token out of the URL

2026-10-12 16:36:00 +02:00

ep0-datastore-copy.md

ep0-copy-gc: fail-safe guards (partial ep0 list aborts, one deletion per run, HOLD file) — from the commit security review; still not installed

2026-10-08 09:58:00 +02:00

gitea-restore.md

R-923/R-924: total-loss-of-dooplex runbook (every recovery secret, where it lives, walked on paper), break-glass sheet (names only), Vaultwarden off-site proven (push, restore test, throwaway start); 'off DooPlex' claims corrected; R-924 filed

2026-10-09 12:13:41 +02:00

iso-release-gate.md

…

logging-conventions.md

…

monthly-floating-retest.md

…

nightly-rotation.md

…

offsite-endpoint.md

…

os-updates-docker-undo.md

…

os-updates-guest-undo.md

…

os-updates-host-undo.md

…

os-updates-test-waits.md

…

pbs-phantom-cleanup.md

R-99 runbook (pbs-phantom-cleanup) + read-only ep0 listing: no phantom today, nothing deleted; R-444 trim measured on demo-hp; R-618 closed by ruling (150 -> 149)

2026-10-06 11:18:14 +02:00

pbs-phantom-list.py

R-99 runbook (pbs-phantom-cleanup) + read-only ep0 listing: no phantom today, nothing deleted; R-444 trim measured on demo-hp; R-618 closed by ruling (150 -> 149)

2026-10-06 11:18:14 +02:00

provider-questions-2026-09-01.md

…

provisioning.md

…

publish-train-rules.md

…

RUNBOOK-appliance-deployment.md

…

RUNBOOK-byo-deployment.md

…

RUNBOOK-ep0-datastore-volume-2026-07-27.md

…

RUNBOOK-escrow-ceremony.md

…

RUNBOOK-hub-db-offsite-backup.md

hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

2026-10-09 12:37:29 +02:00

RUNBOOK-island-migration.md

…

RUNBOOK-local-api-endpoint-drift.md

…

RUNBOOK-manual-build.md

golden 0.298.0 baked (pinned Docker set; the first unpinned bake replaced before any vouch); golden gate test on the gate's UTC clock; bake runbook names GOLDEN_DOCKER_PKGS

2026-10-06 00:47:45 +02:00

RUNBOOK-manual-guest-restore.md

…

RUNBOOK-onboarding-draft-v4.md

…

RUNBOOK-open-retained-package.md

evening Part B: R-304 runbook + close, R-836 closed, R-528/R-435 dated, R-330 wire half closed; R-935 filed (core.bare flips)

2026-10-12 16:45:24 +02:00

RUNBOOK-pbs-prune-serverside-2026-07-27.md

…

RUNBOOK-rehearsal-v3.md

…

RUNBOOK-vzdump-target-move-2026-07-29.md

…

secrets.md

security review part 4: 18 finding rows (R-970..R-987), notes on R-935/R-132/R-908, the rotation date in secrets.md (101 -> 119 rows)

2026-10-12 17:10:19 +02:00

target-selection.md

…

TASK-identity-only-escrow.md

…

total-loss-of-dooplex.md

dooplex-offsite: the operator signing keys ride the nightly encrypted copy; restore test proves each key matches its public half (R-924, operator ruling option A)

2026-10-09 14:49:08 +02:00

VOLUNTEER-first-hour.en.md

…

VOLUNTEER-first-hour.md

website refresh: true numbers (56 apps), claims checked against the capability map, ten missing apps, an English twin of every public page (public, choice B), 404 page; site gates 13-18 + 11 decoys; R-902 opened

2026-10-08 08:29:17 +02:00

workspace-CLAUDE.md

Decisions 149-150 recorded; instruction files kept true; R-890, R-891, R-644 closed, R-469 narrowed (142 -> 139)

2026-10-06 13:52:28 +02:00