permission allowlist: 13 read-only entries; ssh/scp/virsh and creds-matrix DELIBERATELY excluded ...

Transcript scan of the 44 most-recent session JSONLs across both project dirs, counting Bash
command+subcommand pairs and splitting each candidate into LOCAL vs nested-inside-ssh (a
command that only ever runs inside `ssh host '...'` gains nothing from its own rule -- the
outer ssh is what the permission layer matches).

ADDED to permissions.allow only, 31 -> 44 entries. ask/deny/env/hooks untouched, nothing
removed or reordered, JSON re-validated and de-duplicated:
  bash scripts/creds-audit.sh * ; bash scripts/dc-dc-ceph-disk-budget.sh * ;
  bash scripts/site-baseleg.sh check* ; tofu validate* (+ -chdir variant) ;
  tofu state list* (+ -chdir variant) ; tofu state show* ; tofu providers schema* ;
  tofu version* ; ip route* ; systemctl is-active *

The substantive half of this change is what was NOT added:

- ssh (693 calls), scp (47), virsh (234) -- the three biggest prompt sources, left alone.
  They are this cloud's MUTATION TRANSPORT; CLAUDE.md hard rule 3 makes the ask rules the
  enforcement mechanism for per-mutation approval and says not to work around them, and the
  `Bash(ssh *)` disposition is an OPEN operator item queued at the 2026-07-23 close.
  Allowlisting any ssh shape would bypass the gate and pre-empt an unresolved decision.
  THIS COMMIT DOES NOT DISCHARGE THAT QUEUED PRUNE -- it is still open.
- python3 scripts/creds-matrix.py (76 local runs, the largest genuine miss) -- skipped
  because `Bash(*creds-matrix.py *--privileged*)` is an ask rule added 2026-07-26 right after
  the auto-mode classifier incident, and every prefix pattern wide enough to cover the
  observed `... 2>&1 | tail` forms would ALSO match --privileged. Allow-vs-ask precedence was
  not verified, and a rule that might silently downgrade an operator-installed gate is the
  class of change hard rule 3 forbids. Needs the precedence answer, then exact forms.
- tofu plan (54) -- read-only in effect, but CURRENT-STATE section 10 says in terms "Do NOT
  re-run `tofu plan` casually against live state". The prompt is deliberate friction.
- python3 -c/heredocs (324) and shells: arbitrary code execution. curl (114): mutation vector
  via -X/-d. tofu fmt (26): rewrites files. tofu init (10): mutates .terraform/. nft list
  (10): normally needs sudo, which correctly stays ask.

Flagged not fixed: six existing allow entries are redundant with Claude Code's built-in
auto-allow (git status/log, grep, ls, jq, cat scripts/*), and `Bash(git pull*)` sits in allow
though it is a fetch-and-merge. Removing entries was out of scope.

Folded into today's session changelog as item 6 (GA-R2/D1, ONE changelog per session) with a
per-item revert. repo-lint 0-fail; no executable surface changed, so the gauntlet result from
this session's earlier commit (ALL GREEN, 81) still stands.

Revert: drop the 13 appended lines from permissions.allow -- a contiguous deletion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

creds consolidation batch: SEC-021(b) dc0 power key, SEC-025 NetBox GUI, V2 ruled deferral ...

Operator asked whether vcloud holds a consolidated set of login creds for every account that
exists, and what is missing / needs creating / was never moved in. Audited, then cleared the
consolidation batch on operator direction ("clear the whole consolidation batch first").

The audit's own headline: creds-audit read CLEAN on all three sites while the matrix returned
13 findings -- and the two most consequential gaps were in NEITHER surface. They were found by
enumerating the accounts that ACTUALLY EXIST. Absence of a ROW is invisible to the register,
which generalises D-137's founding argument one level up.

VERIFIED POSITIVE (both previously only asserted):
- MAAS account set COMPLETE: all 6 live accounts accounted for; admin + operator passwords on
  vcloud, juju-vr1-dc0/dc1 random+unstored BY RULING with API keys present, MAAS +
  maas-init-node MAAS-internal.
- tier-3 V1 now MEASURES maas-admin-password byte-identical to the headend source-of-record,
  so SEC-020's stale-trap risk is clear as of this date.

DONE:
- dc0 SEC-012 power key consolidated to vcloud + .pub DERIVED (SEC-021(b) as written).
  MEASURED FIRST, because the naming looked like a defect and was not: the headend
  maas-virsh_ed25519 and the snap's id_ed25519 are the SAME key; it IS dedicated (distinct
  from the dc0 service key, which is what SEC-012 requires); and dc0 using the snap's default
  identity is SEC-016's RULED design. So no re-mint, no live power path touched.
- dc1 svc .pub backfilled to the headend store (public-key material, sha256-verified).
- NetBox web-GUI admin password consolidated -- a HUMAN login that had never left the VM it
  was minted on, the third instance of the SEC-009/SEC-020 miss class. SEC-025 OPENED for the
  at-rest exposure the copy CREATES, not the gap it closed. Open rows 20 -> 21.
- V2 taught the ruled-deferral state: SEC-006's standing "revoke at completion of this
  deployment" ruling is now ACKNOWLEDGED (still naming the credential live and exposed)
  instead of failing every run. Reissuing the token would have CONTRAVENED that ruling, so the
  register was what needed to change. Match demands the cased state word AND explicit operator
  ruling attribution, and cannot cross a ledger table cell -- T58/T59 lock the evasion out.
- Added --ledger (default unchanged): V2 read the register via --repo, which the harness must
  point at the real repo for S4, so V2 had shipped with ZERO harness cases. T56-T59 added.

Findings 13 -> 7. Matrix 82 rows, harness 60/60 (was 56), creds-audit CLEAN x3, gauntlet ALL
GREEN (81), repo-lint 0-fail. The register is NOT green and is not expected to be.

RESIDUAL, all recorded: dc0-edge-api x2 (the opnsense-api.txt re-mint is a live edge mutation,
deliberately EXCLUDED from this batch), S5 x3 (RULED by SEC-016 -- needs a ruled-exception
mechanism, operator decision), S6 conflation x1 (the SEC-020 defect), E4 x2 (Stage-5/6 rows).

LOGGED NOT ACTIONED (hard rule 1): no registered root/console credential at EITHER DC edge
(measured absence of row/manifest/SEC row; what those passwords ARE is UNKNOWN and
deliberately unprobed per hard rule 2 -- vector is the LAN-reachable GUI and serial console,
not SSH, which is key-only and proven); plus the two structural blind spots that let it hide
-- S5 compares only cardinality=per-DC while all six per-site rows are office1-only, and
vm-secret-locations declares no rack/edge/cloud/unit/client location though the checker
accepts them.

Revert: per-item reverts in docs/changelog-20260727-creds-consolidation.md. The headend, snap
and NetBox VM source copies were never modified, so every file move is reversible by deletion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf