docs(quick-260731-upz): entropy-audit remediation backlog + tracker items

- Adds F-13 (High) to the audit: the BIP-84 account PRIVATE key is imported
  into Bitcoin Core (bitcoin.rs:203 disable_private_keys=false, :229-231
  wpkh(xprv/...)), so the spending key is persisted outside the Argon2
  envelope in a wallet with an empty passphrase; the descriptors also carry
  no [fingerprint/derivation] key origin, so no hardware signer could ever
  use them. Found by tracing secret class (1) end-to-end
- Fills the Remediation Backlog: R-00..R-15, prioritised severity x effort,
  each with the finding it closes, files, effort, and hardware gating; plus
  an explicit "not implemented here, and why" section
- Records ARCHY-1 as APPLIED with the exact test evidence and an honest note
  that making the source explicit removes a future failure mode rather than
  repairing a past one
- Wires the resulting open items into docs/UNIFIED-TASK-TRACKER.md in its
  existing tier/checkbox format: Tier 0 (cargo audit/deny CI, ceremony
  mnemonic input, a five-item hygiene batch, secrets.rs OsRng), Tier 1 (ISO
  fail-open first-boot secrets, Argon2 vs ADR-005, the on-node checklist),
  Tier 2 (the Critical unauthenticated seed RPCs, PSBT Phase 1, PSBT phases
  2-7, seed-RPC transport confinement)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/UNIFIED-TASK-TRACKER.md

@@ -62,8 +62,89 @@ those are marked ✅ below with the commit that did it, so we stop re-litigating
       installed on any of .116/.198/.228 to check directly; low priority until someone
       actually needs it installed.
 
+- [ ] **Add `cargo audit` / `cargo deny` to CI, failing on duplicate `rand` majors**
+      (entropy audit R-05, finding F-07 —
+      `docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`). `cargo-audit` is not installed
+      anywhere, so no RustSec check has ever run against this tree. Separately,
+      `cargo tree` shows **both** `rand 0.8.5` (direct, all first-party key generation)
+      and `rand 0.9.2` (transitive via `totp-rs` and `tungstenite 0.26.2`) resolved into
+      one binary. `rand 0.9.0` removed `ThreadRng` fork protection and the orchestrator
+      forks constantly, so a future bump must be visible rather than silent — add a
+      `bans` rule so the duplicate majors show up in CI, not in an incident.
+
+- [ ] **Harden the release signing ceremony's mnemonic input** (entropy audit R-08,
+      finding F-06). `ceremony gen` prints the release master mnemonic to **stdout**
+      (`core/archipelago/src/ceremony.rs:71-77`) and `load_release_root_key` prefers the
+      `RELEASE_MASTER_MNEMONIC` **environment variable** over stdin (`:157-160`) — both
+      leak into shell history, `/proc/<pid>/environ`, tmux scrollback and terminal
+      recordings. This is the seed that derives the fleet release-root signing key, so a
+      leak means forged signed manifests fleet-wide. Make stdin/TTY the only supported
+      input for `sign`/`pubkey`; write `gen`'s output to a `0600` file rather than the
+      terminal. Small change, but schedule it deliberately — it is the signing ceremony.
+
+- [ ] **Small entropy-audit hygiene batch** (entropy audit R-09 – R-12, R-14 —
+      `docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`). Five independent one-liners,
+      each closing a Low/Informational finding:
+  - Persist the CSPRNG-readiness verdict (`seed.rs:85-91`) as a durable structured
+    event, so any node can answer post-hoc "was the entropy pool ready when this seed
+    was born?" — the question Coldcard owners cannot answer today.
+  - Add a test asserting the `getrandom` crate uses the **blocking** syscall, making
+    `seed.rs:52-57`'s invariant mechanical instead of a comment.
+  - Clear `_seed_words` from `sessionStorage` on route-leave from onboarding, not only
+    on successful verify (`OnboardingSeedVerify.vue:251`), plus a wall-clock expiry
+    mirroring the server's 10-minute `MNEMONIC_TTL`.
+  - Replace `% charset.len()` in `totp.rs:305` with `SliceRandom::choose(&mut OsRng)`.
+    (No bias today — 32 divides 256 — but any future charset edit introduces one
+    silently. The audit refutes the research's claim that this is currently biased.)
+  - Comment `pickRandomIndices` (`OnboardingSeedVerify.vue:157`) to record that its
+    `Math.random()` picks a UX challenge, not key material, so the next auditor does
+    not re-derive that it is benign.
+
+- [ ] **Swap container `generated_secrets` to explicit `OsRng`** (entropy audit R-13,
+      finding F-10) — `random_hex`/`random_base64` in
+      `core/archipelago/src/container/secrets.rs:90-102` use `thread_rng()`. Correct on
+      `rand 0.8.5`, but the same implicit-source pattern as [ARCHY-1]. Two-line change.
+      **Currently blocked only on tree hygiene** — that file had another agent's
+      uncommitted work when the audit ran.
+
 ## Tier 1 — Medium effort, unblocked
 
+- [ ] **Fix the fail-open first-boot secret regeneration in the ISO** (entropy audit
+      R-02 + R-03, finding F-03 — `docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`).
+      The installed rootfs is a **cached container export shared by every node**
+      (`image-recipe/_archived/build-auto-installer-iso.sh:717-726`, extracted at
+      `:2303`), and it bakes SSH host keys (via the `openssh-server` install at `:345`)
+      and a TLS keypair (`:463-469`). `archipelago-first-boot-secrets.service` correctly
+      regenerates both per device — but both branches are **fail-open** (`:1647`,
+      `:1659`) and `touch "$MARKER"` at `:1663` runs **unconditionally**, so a single
+      transient failure permanently leaves that node on the image-wide shared SSH host
+      key and TLS private key, with the failure visible only in a log file. Fix:
+      (a) set the marker only when both regenerations succeeded, so it retries next
+      boot; (b) surface the failure in the UI/doctor, not just the log; (c) strip the
+      baked keys from the rootfs tar so a failure degrades to "no key" rather than
+      "shared key". Needs an ISO rebuild and two fresh flashes to verify.
+
+- [ ] **Reconcile `Argon2::default()` with ADR-005** (entropy audit R-06, finding F-05).
+      ADR-005 states 64 MB / 3 iterations
+      (`docs/adr/005-chacha20-backup-encryption.md:31`); `Argon2::default()` in
+      argon2 0.5.3 is Argon2id at **19 MiB / t=2 / p=1**. Used at
+      `core/archipelago/src/seed.rs:249` and `:285`, `backup/identity.rs:38`/`:93`,
+      `backup/full.rs:618`/`:650`. Either raise the parameters behind a versioned
+      envelope **with a migration** (an existing `master_seed.enc` was encrypted under
+      the old parameters and will not decrypt under new ones) or amend the ADR to state
+      the real numbers. Do not change them silently.
+
+- [ ] **Run the on-node entropy verification checklist** (entropy audit R-15, §6 of
+      `docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`). Everything in that section is
+      explicitly **UNVERIFIED** — it needs real hardware this environment cannot reach.
+      Highest value first: **C-3** (are SSH host-key and TLS fingerprints actually
+      different across two nodes flashed from the same ISO?) and **C-5** (the cross-node
+      same-ISO seed collision test — the empirical check that would have caught the
+      Coldcard defect). Also C-1 (`crng init done` vs seed-generation timestamp), C-2
+      (`machine-id` uniqueness), C-4 (what the rootfs tar actually contains, run on the
+      build host), C-6 (is `/rpc/v1` reachable unauthenticated from the LAN). Use a
+      disposable node — C-5 overwrites node identity.
+
 - [x] ~~immich → Quadlet migration~~ — investigated 2026-07-01, turned out already done:
       immich uses the same `install_stack_via_orchestrator` primitive as netbird/btcpay
       (`immich_stack_app_ids()` in `stacks.rs:690`), and is confirmed running as real
@@ -86,6 +167,63 @@ those are marked ✅ below with the commit that did it, so we stop re-litigating
 
 ## Tier 2 — High effort, mostly unblocked (the actual next exit criteria)
 
+- [ ] **🔴 Gate the unauthenticated seed RPCs** (entropy audit R-01, finding **F-01,
+      Critical** — `docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`). `seed.generate`,
+      `seed.verify`, `seed.restore` and `seed.save-encrypted` are in
+      `UNAUTHENTICATED_METHODS` (`core/archipelago/src/api/rpc/middleware.rs:24-28`),
+      which skips session, RBAC **and** CSRF (`api/rpc/mod.rs:263`, `:295`, `:326`).
+      Neither handler checks whether onboarding is already complete
+      (`api/rpc/seed_rpc.rs:93-159`, `:226-305`), and `NodeIdentity::from_seed`
+      overwrites `node_key`, `nostr_secret` and the FIPS mesh key **unconditionally**
+      (`identity.rs:79-114`). There is no rate limit (`rate_limit.rs:60-97` has no
+      `seed.*` entry). The endpoint is proxied to the LAN over plaintext HTTP
+      (`image-recipe/configs/nginx-archipelago.conf:11`, `:165`, `:192`) and mesh peers
+      can reach it too (`server.rs:2080` asserts `/rpc/v1` passes the peer path filter).
+      Net: **one unauthenticated POST can take over or destroy a live node's identity**,
+      and `seed.restore` lets the attacker choose the mnemonic. The guard already exists
+      and is simply never called — `NodeIdentity::key_exists` (`identity.rs:117`).
+      Fix: bail when a node key exists and no onboarding mnemonic is pending; prefer
+      also gating on `auth_manager.is_onboarding_complete()`; add rate limits at
+      `auth.changePassword` strictness; narrow the peer path filter. Changes an
+      authentication boundary on a live fleet — **needs its own `/gsd-plan-phase` with a
+      federation re-verify**, not an opportunistic patch.
+
+- [ ] **PSBT-first signing: Phase 1 — move the Bitcoin private key out of Core**
+      (entropy audit R-04, finding **F-13** + `docs/security/PSBT-SIGNING-ARCHITECTURE.md`
+      §8 Phase 1). `handle_bitcoin_init_wallet_from_seed` passes
+      `disable_private_keys = false` (`core/archipelago/src/api/rpc/bitcoin.rs:203`) and
+      imports `wpkh(xprv/0/*)` / `wpkh(xprv/1/*)` (`:229-231`), so the BIP-84 account
+      **private** key is persisted in Bitcoin Core's `wallet.dat` — with an empty wallet
+      passphrase (`:205`) — in addition to the daemon's Argon2 envelope. The descriptors
+      also carry **no `[fingerprint/derivation]` key origin**, so no hardware signer
+      could ever locate its key even if the private key were removed. Fix: watch-only
+      (`disable_private_keys=true`) + xpub-with-origin descriptors + a migration that
+      verifies balance and UTXO parity **before** removing the old wallet. This is the
+      single highest-value change in the PSBT spec and unblocks every later phase.
+      Needs a node with real UTXO history to verify.
+
+- [ ] **PSBT-first signing: Phases 2-7 rollout**
+      (`docs/security/PSBT-SIGNING-ARCHITECTURE.md` §8) — the spec is written to be
+      consumed directly by `/gsd-plan-phase`, with per-phase goals, dependencies,
+      candidate requirements and hardware gating. Sequence: PSBT construct/export →
+      external-signer import + finalize → air-gap transport (BC-UR v2 primary, BBQr for
+      Coldcard, file fallback always) → `wsh(sortedmulti)` multisig on BIP-48 → LND
+      remote signing → hot-wallet spend limits and cold/warm/hot tiering. Two hard rules
+      the spec fixes in place: a channel-funding PSBT must **never** be self-broadcast
+      (funds can be lost), and no UI copy may imply a routing node's Lightning channel
+      keys are cold — they are necessarily hot. Phases 3-6 need real hardware.
+
+- [ ] **Confine the seed-bearing RPCs to loopback/TLS** (entropy audit R-07, finding
+      F-04 / [ARCHY-4]). The 24-word master mnemonic is returned to the browser over
+      JSON-RPC (`core/archipelago/src/api/rpc/seed_rpc.rs:147`, `:156-158`), held in
+      process memory under a 10-minute TTL (`:27`) and deliberately **not** cleared at
+      verify time (`:205-211`, with a documented and defensible rationale about client
+      retries) — over a transport that is plaintext HTTP on LAN by design
+      (`api/rpc/mod.rs:227-241`). Anyone with LAN traffic visibility during onboarding
+      reads the phrase that unlocks the wallet and the node identity. Fix: force TLS or
+      loopback for seed methods, shrink the TTL, and clear on an acknowledged verify
+      with a short grace window. Touches the onboarding transport — needs a phase.
+
 - [~] **Multinode test pass** (`docs/multinode-testing-plan.md`) — worked the
       preconditions on .198 2026-07-01:
   - ✅ cleared 2 stale failed-unit records (`archy-mempool-db.service`,