security: remove all infrastructure and internal process material from the repo

The repo is source code and guidelines only. Nothing about how Archipelago's
own fleet is run, or how the team works, stays in it.

Untracked (kept on disk, gitignored) — 250 files:
- .planning/ (199) and loop/ — internal development process
- fleet operations tooling that targets specific nodes: deploy-to-target,
  deploy-tailscale, deploy-config-defaults, setup-target-dev, setup-aiui-server,
  setup-https-dev, debug-frontend, node-profile, fleet-fips-pair/unpair,
  image-recipe/sync-from-live.sh
- image-recipe/INTEGRATION-GUIDE.md and docs/multinode-testing-plan.md, both of
  which are live-server workflow and fleet node inventories
- the Phase 10 on-node verification and evidence records, which cite .planning/
  as their evidence base

KEY-05-ENTROPY-ENFORCEMENT.md was initially moved out with the other Phase 10
docs and then put back: it is cited as normative rationale from ten places in
the codebase, including core/clippy.toml, which bans rand::thread_rng and
points at it for the reason. That makes it a guideline, not an internal record.

Node names removed from source (48 occurrences across comments, manifests and
test fixtures): archi-dev-box, archy-x250*, shorty-s, framework-pt,
zaza-optiplex, archi-thinkpad. Comments keep the engineering context and the
date, which is what carried the meaning; the machine name did not.

Three of those were live test values rather than comments and were replaced
with valid stand-ins, not prose: two mDNS hostnames and a mesh peer name.
An earlier pass substituted "a test node" into a hostname assertion, producing
an invalid hostname; caught and fixed as test-node.local.

Wipe mechanism: .local-only/manifest.txt inventories every local-only path and
.local-only/wipe.sh deletes them on one confirmation, refusing to touch
anything git still tracks. Both are themselves untracked, so the public repo
does not carry a map of internal filenames.

Verified: cargo check -p archipelago --all-features clean; archipelago-container
75/75 tests pass; appOrigin vitest 7/7; audit-secrets 5/5; every relative link
in tracked markdown resolves (0 broken).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/handler/mod.rs

@@ -641,7 +641,7 @@ impl ApiHandler {
             //   proxy INTO it, it binds 0.0.0.0, and it is explicitly on the
             //   fips0 mesh allowlist (fips/app_ports.rs). So an unauthenticated
             //   GET from any mesh peer, LAN host or Tailscale peer returned the
-            //   admin macaroon. Verified live on archi-dev-box 2026-08-02.
+            //   admin macaroon. Verified live on a test node 2026-08-02.
             //
             // The lesson generalises: an auth check performed by one reverse
             // proxy is not an auth check, because it only holds for traffic that

core/archipelago/src/api/rpc/lnd/mod.rs

@@ -120,7 +120,7 @@ async fn stream_lnd_transactions(sm: &crate::state::StateManager) -> Result<()>
     Ok(())
 }
 
-/// LND wedge watchdog (2026-07-22, "100% uptime"): framework-pt's LND sat
+/// LND wedge watchdog (2026-07-22, "100% uptime"): a test node's LND sat
 /// for 14 HOURS with its RPC answering but the server never finishing
 /// startup — synced_to_chain=false, zero peers, every channel inactive —
 /// and nothing noticed until a human tried to open a channel. The wedge

core/archipelago/src/api/rpc/lnd/payments.rs

@@ -80,7 +80,7 @@ impl RpcHandler {
         // a couple of seconds and still get their answer in one round trip,
         // while a slow multi-hop route flips the UI into its "settling…"
         // polling state (lnd.paymentstatus every 3s) after ~8s instead of
-        // freezing the modal for two minutes with no feedback (framework-pt
+        // freezing the modal for two minutes with no feedback (a test node
         // user report, 2026-07-29).
         let pay_client = reqwest::Client::builder()
             .no_proxy()

core/archipelago/src/api/rpc/lnd/wallet.rs

@@ -196,7 +196,7 @@ impl RpcHandler {
             // input to create sweep tx: input_sum=0 BTC, output_sum=…").
             // input_sum=0 with a tiny output means the wallet's coins are
             // unconfirmed or below Bitcoin's dust minimum — say that
-            // (framework-pt sweep of 92 sats, 2026-08-06).
+            // (a test node sweep of 92 sats, 2026-08-06).
             if msg.contains("insufficient input to create sweep tx") {
                 return Err(anyhow::anyhow!(
                     "Failed to send: your on-chain balance is too small or still \
@@ -566,7 +566,7 @@ impl RpcHandler {
 
         // See `build_invoice_request_body` for why `private: true` is
         // unconditional. This is the wallet UI's Receive flow / the
-        // `lnd.createinvoice` RPC — the bug diagnosed on archy-x250-mad2.
+        // `lnd.createinvoice` RPC — the bug diagnosed on a test node.
         let invoice_body = build_invoice_request_body(amount_sats, memo);
 
         let resp = match client

core/archipelago/src/api/rpc/middleware.rs

@@ -81,7 +81,7 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "Insufficient funds",
         // On-chain send/sweep refusals from LND ("Failed to send: your
         // on-chain balance is too small or still unconfirmed to sweep…").
-        // Masking sent the operator to journalctl again (framework-pt
+        // Masking sent the operator to journalctl again (a test node
         // sweep, 2026-08-06) — same lesson as the two above.
         "Failed to send",
         // A frontend newer than the daemon calls methods it doesn't have.
@@ -201,7 +201,7 @@ mod sanitize_tests {
     fn lightning_payment_errors_pass_through() {
         // LND's payment-failure reasons are written for the payer — masking
         // "invoice expired" as "Check server logs" left a user retrying a
-        // dead invoice (framework-pt, 2026-07-23).
+        // dead invoice (a test node, 2026-07-23).
         for msg in [
             "Payment failed: this invoice has expired (Valid until 2026-07-23 07:41:42 +0000 UTC). Ask the recipient for a fresh invoice and try again.",
             "Payment failed: unable to find a path to destination",

core/archipelago/src/api/rpc/package/install.rs

@@ -2240,7 +2240,7 @@ async fn cleanup_stale_pasta_port(port: &str) {
     // NEVER kill our own process. The daemon holds catalog app ports over
     // IPv6 (the mesh app-port relay), so a blunt `fuser -k <port>/tcp` would
     // terminate archipelago itself mid-install — installs failed and apps
-    // vanished on framework-pt 2026-07-27. Kill every listener on the port
+    // vanished on a test node 2026-07-27. Kill every listener on the port
     // EXCEPT our PID (and our process group), leaving the relay/daemon alive.
     let self_pid = std::process::id();
     let kill_listener = format!(

core/archipelago/src/api/rpc/package/pine_ha.rs

@@ -131,7 +131,7 @@ rest:
       Authorization: "Bearer {token}"
     # 15s: the mesh-message sensor only carries the LATEST message id, so two
     # messages inside one poll window coalesce and only the newest announces
-    # (observed on framework-pt 2026-07-22). Halving the window halves both
+    # (observed on a test node 2026-07-22). Halving the window halves both
     # the announce lag and the coalescing odds; the endpoint is local + cheap.
     scan_interval: 15
     sensor:
@@ -352,7 +352,7 @@ const MESH_ANNOUNCE_AUTOMATION_ID: &str = "archy_mesh_announce";
 /// state before the first-ever received message (and again whenever the mesh
 /// message store restarts empty), and `unavailable` follows any endpoint
 /// blip — blocking those swallowed the first DM a fresh node ever received
-/// (framework-pt, 2026-07-22). HA restarts still can't re-announce an old
+/// (a test node, 2026-07-22). HA restarts still can't re-announce an old
 /// message: rest sensors don't restore state, so the post-restart transition
 /// is always from `unknown`.
 const MESH_ANNOUNCE_AUTOMATION: &str = r#"- id: archy_mesh_announce
@@ -724,7 +724,7 @@ async fn seed_assist_pipeline(storage: &std::path::Path, claude_entity: Option<&
 ///
 /// HA's zeroconf discovery stores a satellite as a fixed LAN IP. DHCP
 /// renumbering — or the whole node moving to a different network — strands
-/// the entry and the speaker silently drops (framework-pt 2026-07-23: entry
+/// the entry and the speaker silently drops (a test node 2026-07-23: entry
 /// pinned to 192.168.1.241 while the LAN had become 192.168.63.0/24). HA
 /// never re-resolves on its own. This keeper probes each satellite entry and,
 /// when one stops answering, sweeps the node's local /24s for the same

core/archipelago/src/api/rpc/tor/mod.rs

@@ -155,7 +155,7 @@ pub(super) fn detect_hidden_service_base() -> String {
 ///
 /// Derived at runtime, never hardcoded: `archy-net` is created without an
 /// explicit subnet (see docker-compose.yml), so podman allocates one — it is
-/// 10.89.0.0/24 on archi-dev-box but there is no guarantee of that on another
+/// 10.89.0.0/24 on a test node but there is no guarantee of that on another
 /// node, and a hardcoded guess would fail silently by binding SOCKS to an
 /// address no container can reach.
 ///