diff --git a/.planning/WINDOWS.md b/.planning/WINDOWS.md index 78927357..a9fdba22 100644 --- a/.planning/WINDOWS.md +++ b/.planning/WINDOWS.md @@ -1,10 +1,10 @@ --- schema_version: 1 -open_count: 12 +open_count: 13 waived_count: 0 fixed_count: 1 -total_count: 13 -last_updated: 2026-08-02T19:07:40.522Z +total_count: 14 +last_updated: 2026-08-02T22:44:15.215Z --- # Broken Windows Ledger @@ -28,6 +28,7 @@ last_updated: 2026-08-02T19:07:40.522Z | 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md | | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open | | 2026-08-02T19:07:39.861Z | | | 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh | | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open | | 2026-08-02T19:07:40.217Z | | | 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs | | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | open | | 2026-08-02T19:07:40.522Z | | +| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open | | 2026-08-02T22:44:15.215Z | | ````json [ @@ -186,6 +187,18 @@ last_updated: 2026-08-02T19:07:40.522Z "reason": "", "recorded_at": "2026-08-02T19:07:40.522Z", "resolved_at": null + }, + { + "id": 14, + "kind": "unrun-verify", + "phase": "10", + "file": "core/archipelago/src/container/prod_orchestrator.rs", + "line": null, + "description": "LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched.", + "status": "open", + "reason": "", + "recorded_at": "2026-08-02T22:44:15.215Z", + "resolved_at": null } ] ```` diff --git a/docker/lnd-ui/lnd.svg b/docker/lnd-ui/lnd.svg deleted file mode 100644 index 05df934e..00000000 --- a/docker/lnd-ui/lnd.svg +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - - - - - - - - - - - - - - -