# vm-secret-locations -- the ABSOLUTE bound on credential discovery (D-137 ruling 3).
#
# RULING 3, 2026-07-26, operator utterance "Declared locations only": this list bounds
# `--remote` ABSOLUTELY. The sweep visits these locations and NOTHING else. It never walks
# a host looking for secrets, never expands beyond a listed path, and never touches a
# tenant surface -- D-069 (tenant credential custody stays off-repo) is preserved BY
# CONSTRUCTION rather than by the sweep's good behaviour.
#
# ADDING A ROW HERE IS DEFINITION-OF-DONE FOR ANY NEW MINT SITE. A location that is not
# listed is not audited, and an unaudited location is how SEC-022 happened.
#
# WHY EACH CLASS IS PRESENT (the ruling's faithful-implementation note):
#   - per-site creds folders on the JUMPHOST      -- the SEC-009 convention itself
#   - per-site creds folders on the HEADEND       -- SEC-022, the shadow stores that were
#     structurally invisible: creds-audit resolves the folder against $HOME on whatever
#     host it runs on and contains no ssh at all, so a headend-resident store could never
#     be seen. D-128 puts Plane-2 execution on the headend, so these keep appearing.
#   - the region secrets dir                      -- SEC-020, where admin.pass sat
#     root-only for 12 days while the audit read CLEAN
#   - the three dirs outside the SEC-009 convention (research FINDING 2)
#   - the PKI overlay inside the repo clone       -- a CA private key plus a plaintext
#     passphrase, gitignored, in a repo SEC-004 records as currently PUBLIC
#
# ON THE TENANT DIRECTORIES, which look like a contradiction and are not: the per-tenant
# directories listed below are LOCAL operator-held copies on the jumphost. They are NOT a
# tenant surface. `ssh-target=local` is load-bearing -- no tenant VM, tenant project, or
# tenant-operated host is reachable from this file, and none may ever be added to it.
#
# FORMAT. Whitespace-separated: <host-role> <ssh-target> <path>
#   host-role   the role token used by creds-matrix.tsv (jumphost|headend|netbox|...)
#   ssh-target  `local` = the host this runs on (the jumphost), else an ssh alias from
#               the D-126 ssh_config fragment (scripts/site-ssh-config.sh) -- these are
#               MEASURED as-built aliases, never invented hostnames
#   path        an absolute path or a `~`-relative one, expanded on the TARGET host.
#               A trailing `/*` means "the files directly in this directory".
# `#` comments and blank lines ignored. NO FIELD MAY CONTAIN WHITESPACE.
#
# A listed location that does not exist is NOT a failure -- it is reported as an explicit
# skip. Several of these belong to deployment stages this rehearsal has not reached.

# --- jumphost (vcloud): the SEC-009 convention -------------------------------
jumphost  local  ~/vr1-office1-creds/*
jumphost  local  ~/vr1-dc0-creds/*
jumphost  local  ~/vr1-dc1-creds/*

# --- jumphost: OUTSIDE the SEC-009 convention (research FINDING 2) -----------
# Named in CLAUDE.md as secret locations, so KNOWN -- simply outside the control until now.
jumphost  local  ~/vault-init/*
jumphost  local  ~/octavia-pki/*
jumphost  local  ~/tenant-*/*
# The PKI overlay lands INSIDE the repo clone (gitignored). `<repo>` is substituted at
# runtime from the checker's own location -- the repo has been renamed once already
# (D-110) and its name must never be hardcoded into a command or a data file.
jumphost  local  <repo>/overlays/octavia-pki.yaml
# DOCFIX-175: the Office1 MAAS API key reaches tfstate in PLAINTEXT. A secret-at-rest
# location with no mint of its own -- declared so the copy is audited, not just the mint.
jumphost  local  <repo>/opentofu/terraform.tfstate

# --- headend (voffice1): the SEC-022 shadow stores + the region secrets dir ---
# The region dir is root-owned; the sweep reads METADATA ONLY (existence, mode, digest)
# and never file content.
headend  voffice1  ~/vr1-dc0-creds/*
headend  voffice1  ~/vr1-dc1-creds/*
headend  voffice1  /root/maas-secrets/*

# --- netbox VM: the founding SEC-009 miss ------------------------------------
netbox  office1-netbox  /root/netbox-secrets/*
