# vm-secret-locations -- the ABSOLUTE bound on credential discovery (D-137 ruling 3).
#
# RULING 3, 2026-07-26, operator utterance "Declared locations only": this list bounds
# `--remote` ABSOLUTELY. The sweep visits these locations and NOTHING else. It never walks
# a host looking for secrets, never expands beyond a listed path, and never touches a
# tenant surface -- D-069 (tenant credential custody stays off-repo) is preserved BY
# CONSTRUCTION rather than by the sweep's good behaviour.
#
# ADDING A ROW HERE IS DEFINITION-OF-DONE FOR ANY NEW MINT SITE. A location that is not
# listed is not audited, and an unaudited location is how SEC-022 happened.
#
# WHY EACH CLASS IS PRESENT (the ruling's faithful-implementation note):
#   - per-site creds folders on the JUMPHOST      -- the SEC-009 convention itself
#   - per-site creds folders on the HEADEND       -- SEC-022, the shadow stores that were
#     structurally invisible: creds-audit resolves the folder against $HOME on whatever
#     host it runs on and contains no ssh at all, so a headend-resident store could never
#     be seen. D-128 puts Plane-2 execution on the headend, so these keep appearing.
#   - the region secrets dir                      -- SEC-020, where admin.pass sat
#     root-only for 12 days while the audit read CLEAN
#   - the three dirs outside the SEC-009 convention (research FINDING 2)
#   - the PKI overlay inside the repo clone       -- a CA private key plus a plaintext
#     passphrase, gitignored, in a repo SEC-004 records as currently PUBLIC
#
# ON THE TENANT DIRECTORIES, which look like a contradiction and are not: the per-tenant
# directories listed below are LOCAL operator-held copies on the jumphost. They are NOT a
# tenant surface. `ssh-target=local` is load-bearing -- no tenant VM, tenant project, or
# tenant-operated host is reachable from this file, and none may ever be added to it.
#
# FORMAT. Whitespace-separated: <host-role> <site-key> <ssh-target> <path>
#   host-role   the role token used by creds-matrix.tsv (jumphost|headend|netbox|...)
#   site-key    region-qualified site this location belongs to, or `-` if not site-scoped.
#               ADDED 2026-07-26 (committee finding): without it the checker matched
#               credentials on (role, basename) alone, so a file in ONE site's folder
#               satisfied the row for EVERY site -- which masked SEC-021's dc0
#               opnsense-api.txt absence. A per-DC credential must be resolved against its
#               OWN site's location or the check is decorative.
#   ssh-target  `local` = the host this runs on (the jumphost), else an ssh alias from
#               the D-126 ssh_config fragment (scripts/site-ssh-config.sh) -- these are
#               MEASURED as-built aliases, never invented hostnames
#   path        an absolute path or a `~`-relative one, expanded on the TARGET host.
#               A trailing `/*` means "the files directly in this directory".
# `#` comments and blank lines ignored. NO FIELD MAY CONTAIN WHITESPACE.
#
# A listed location that does not exist is NOT a failure -- it is reported as an explicit
# skip. Several of these belong to deployment stages this rehearsal has not reached.

# --- jumphost (vcloud): the SEC-009 convention -------------------------------
jumphost  vr1-office1  local  ~/vr1-office1-creds/*
jumphost  vr1-dc0      local  ~/vr1-dc0-creds/*
jumphost  vr1-dc1      local  ~/vr1-dc1-creds/*

# --- jumphost: OUTSIDE the SEC-009 convention (research FINDING 2) -----------
# Named in CLAUDE.md as secret locations, so KNOWN -- simply outside the control until now.
jumphost  -            local  ~/vault-init/*
jumphost  -            local  ~/tenant-*/*
# The PKI overlay lands INSIDE the repo clone (gitignored). `<repo>` is substituted at
# runtime from the checker's own location -- the repo has been renamed once already
# (D-110) and its name must never be hardcoded into a command or a data file.
# Both the overlay and the workspace are declared PER DC below; the old shared-scope
# `~/octavia-pki/*` and `<repo>/overlays/octavia-pki.yaml` entries were retired with the
# F1 rename of 2026-07-29 and would now match nothing.
# DOCFIX-175: the Office1 MAAS API key reaches tfstate in PLAINTEXT. A secret-at-rest
# location with no mint of its own -- declared so the copy is audited, not just the mint.
jumphost  vr1-office1  local  <repo>/opentofu/terraform.tfstate
# Committee finding: the tfstate SIBLINGS carry the same plaintext key and were unaudited.
jumphost  vr1-office1  local  <repo>/opentofu/terraform.tfstate.backup
jumphost  vr1-office1  local  <repo>/opentofu/terraform.tfstate.pre-*
# ~/as-executed/ is DELIBERATELY NOT declared. CLAUDE.md names it as material never to
# read into context, and the PreToolUse guard enforces that -- but it holds session LOGS,
# not registered credentials, so declaring it made every log a false UNDECLARED finding.
# Its risk is transcript CONTENT, which this register does not model; that is the guard's
# job, not the matrix's. Recorded here so the omission is a decision, not an oversight.
# The Octavia PKI artifacts are written into THREE SUBDIRECTORIES (phase-01:288), so the
# bare ~/octavia-pki/* pattern matched ZERO of the 8 artifacts incl. two CA private keys.
# Octavia PKI is PER-DC since 2026-07-29 (D-109 amendment / R7, F1). Each DC is a separate
# trust domain on disk, so the locations are declared per DC rather than as one shared pool:
# both DCs' workspaces contain identically-named basenames, and a shared `-` scope would
# collapse them into one namespace where a missing dc1 file is indistinguishable from a
# present dc0 one -- reintroducing exactly the blindness F2 removed from the matrix.
# HOST-ROLE IS `headend`, RULED 2026-07-29 (D-109 ruling note (b), operator: "Generate on
# voffice1 (Recommended)"). juju is ABSENT on vcloud and 3.6.27 on voffice1, and the deploy
# runs from voffice1 -- so generating on the jumphost would mint the PKI on a host the deploy
# cannot read it from. Generate-then-transfer was declined: a second at-rest copy of a CA
# private key plus a plaintext passphrase widens the SEC-004 exposure R7 refused to widen.
# `local` (not the voffice1 ssh-target) so the F6 host binding governs: on vcloud these read
# NOT PROBED rather than absent, and on voffice1 they are probed for real.
headend   vr1-dc0      local  ~/octavia-pki/vr1-dc0/issuing-ca/*
headend   vr1-dc0      local  ~/octavia-pki/vr1-dc0/controller-ca/*
headend   vr1-dc0      local  ~/octavia-pki/vr1-dc0/controller/*
headend   vr1-dc0      local  <repo>/overlays/vr1-dc0-octavia-pki.yaml
headend   vr1-dc1      local  ~/octavia-pki/vr1-dc1/issuing-ca/*
headend   vr1-dc1      local  ~/octavia-pki/vr1-dc1/controller-ca/*
headend   vr1-dc1      local  ~/octavia-pki/vr1-dc1/controller/*
headend   vr1-dc1      local  <repo>/overlays/vr1-dc1-octavia-pki.yaml
# Predicted Stage-5 exposure (SEC-023): phase-03 writes $HOME/admin-openrc.
jumphost  -            local  ~/admin-openrc

# --- headend (voffice1): the SEC-022 shadow stores + the region secrets dir ---
# The region dir is root-owned; the sweep reads METADATA ONLY (existence, mode, digest)
# and never file content.
headend   vr1-dc0      voffice1  ~/vr1-dc0-creds/*
headend   vr1-dc1      voffice1  ~/vr1-dc1-creds/*
headend   vr1-office1  voffice1  /root/maas-secrets/*
# MEASURED 2026-07-26: the CLI profile, the Juju client store, the MAAS snap ssh dir (which
# holds the per-DC power keys) and the rack-enrollment secret all live OUTSIDE the region
# secrets dir. Each was an inferred path in the first matrix draft; these are the real ones.
headend   vr1-office1  voffice1  ~/snap/maas/current/.maascli.db
headend   -            voffice1  ~/.local/share/juju/*
headend   -            voffice1  /var/snap/maas/current/root/.ssh/*
headend   vr1-office1  voffice1  /var/snap/maas/common/maas/secret

# --- netbox VM: the founding SEC-009 miss ------------------------------------
netbox    vr1-office1  office1-netbox  /root/netbox-secrets/*
# The per-DC MAAS REGION controller VMs (D-132 amendment, 2026-07-30). Adding these rows is
# definition-of-done for the new mint site: the region VM mints its own DB password and
# admin password, and an unlisted location is not audited -- which is exactly how SEC-022
# happened. Reached ONLY through their DC's rack (no L3 route from vcloud or the headend to
# any DC node plane -- SEC-010 + isolated libvirt nets, see D-138).
region    vr1-dc0      ssh    vr1-dc0-maas:~/.maas-db-pw
region    vr1-dc0      ssh    vr1-dc0-maas:~/.maas-admin-pw
region    vr1-dc1      ssh    vr1-dc1-maas:~/.maas-db-pw
region    vr1-dc1      ssh    vr1-dc1-maas:~/.maas-admin-pw
rack      vr1-dc0      ssh    vr1-dc0-rack:~/vr1-dc0-creds/*
rack      vr1-dc0      ssh    vr1-dc0-rack:~/.local/share/juju/*
rack      vr1-dc1      ssh    vr1-dc1-rack:~/vr1-dc1-creds/*
rack      vr1-dc1      ssh    vr1-dc1-rack:~/.local/share/juju/*
rack      vr1-dc0      ssh    vr1-dc0-rack:~/repo-stage/overlays/vr1-dc0-octavia-pki.yaml
rack      vr1-dc1      ssh    vr1-dc1-rack:~/repo-stage/overlays/vr1-dc1-octavia-pki.yaml
