docs: add FED-07 fedimint gateway default-password blocker (phase 1)

.planning/REQUIREMENTS.md

@@ -18,6 +18,7 @@ declared exit criteria (multinode pass + workstreams B/C/F), `.planning/codebase
 - [ ] **FED-04**: Mesh messaging parity — attachment send (and the rest of the mesh chat surface) behaves identically on the demo and on real nodes: the demo backend implements the same RPC surface the UI calls, transport decisions mirror the real size-based tier logic, and no demo-only modals exist
 - [ ] **FED-05**: Inter-node Lightning channel opening UX — the UI shows the node's shareable Lightning URI; lists trusted (federated) nodes by hostname for one-click channel opening; and lets the user browse/request channels with public nodes — using the existing design system and components, verified on the :8100 dev preview against archi-dev before deploy
 - [ ] **FED-06**: On-brand payment success animation — the invoice "paid" tick's circle uses the screensaver-style ring with outer EQ-segment lines (reuse `ScreensaverRing.vue`'s compact size) in place of the current success burst, applied consistently everywhere the paid tick shows
+- [ ] **FED-07**: Fedimint gateway never installs with a pre-set password — gateway credentials are generated per-install via manifest-declared `generated_secrets` (or explicitly set by the user), never baked into the image/manifest; existing installs with the default password get a migration path (BLOCKER — default credentials are a security hole)
 
 ### UI Performance (PERF)
 
@@ -100,6 +101,7 @@ Which phases cover which requirements. Updated during roadmap creation.
 | FED-04 | Phase 1 | Pending |
 | FED-05 | Phase 1 | Pending |
 | FED-06 | Phase 1 | Pending |
+| FED-07 | Phase 1 | Pending |
 | PERF-01 | Phase 2 | Complete |
 | PERF-02 | Phase 2 | In Progress (02-02 tracer done; 02-04..02-07 extend to remaining tabs) |
 | PERF-03 | Phase 2 | Pending |

.planning/ROADMAP.md

@@ -34,7 +34,7 @@ signed/decentralized registry and a user installs it on their node.
 
 **Goal**: Federation and mesh are tight — a structured review of the fleet/federation and mesh code feeds fixes so node removal sticks, sync converges, and mesh messaging (including attachments) behaves identically everywhere it runs
 **Depends on**: Nothing (first phase)
-**Requirements**: FED-01, FED-02, FED-03, FED-04, FED-05, FED-06
+**Requirements**: FED-01, FED-02, FED-03, FED-04, FED-05, FED-06, FED-07
 **Success Criteria** (what must be TRUE):
 
   1. A structured code review of the federation/fleet area (`core/archipelago/src/federation`, node sync, FIPS/transport dial layer) and the mesh area (`core/archipelago/src/mesh`, mesh RPC surface) produces a findings list, and every finding is fixed or explicitly deferred with a reason
@@ -43,6 +43,7 @@ signed/decentralized registry and a user installs it on their node.
   4. Mesh attachment send works identically on the demo and on real nodes — same modals, same transport decisions, same success — with the demo backend implementing the same RPC surface the UI calls (no "Method not found", no demo-only chooser modal)
   5. Channel-opening between nodes is first-class UI: a user can copy/share their node's Lightning URI; sees a list of trusted (federated) nodes by hostname to open a channel with in one flow; and can browse/request channels with public nodes — built with the existing design system (Teleport-to-body modals, house style), tested live on the :8100 dev preview against archi-dev, and fixed there before any deploy
   6. The invoice/payment "paid" success animation is on-brand: the tick's circle is the screensaver-style ring with the outer EQ-segment lines (reuse `neode-ui/src/components/ScreensaverRing.vue`, which already ships a `compact` overlay size), replacing the current burst in the payment success pane (`neode-ui/src/components/SendBitcoinModal.vue`) and matching wherever else the paid tick appears
+  7. Fedimint gateway installs have no pre-set password (BLOCKER, added 2026-07-30): a fresh install generates its gateway credentials per-install via manifest-declared `generated_secrets` (per the repo secrets invariant) or requires the user to set one — never a baked-in default; existing installs carrying the default password are migrated or flagged. NOTE: phase 1's 10 plans predate this criterion — an additional gap plan is required before phase 1 execution completes
 
 **Plans**: 10 plans
 

.planning/STATE.md

@@ -102,6 +102,7 @@ Decisions are logged in PROJECT.md (10 locked ADRs in the `<decisions>` block +
 ### Pending Todos
 
 - [blocker/ui] Keep FIPS/Tor pills on cloud files and show them on mobile (`.planning/todos/pending/2026-07-30-keep-fips-tor-pills-on-cloud-files-and-show-them-on-mobile.md`)
+- [blocker/security] Fedimint gateway must not install with a pre-set password — tracked as FED-07 / Phase 1 gap plan (`.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md`)
 
 ### Blockers/Concerns
 

.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md

@@ -0,0 +1,21 @@
+---
+created: 2026-07-30T22:19:31.770Z
+title: Fedimint gateway must not install with a pre-set password
+area: security
+severity: blocker
+files:
+  - core/archipelago/src (app orchestrator / secrets materialisation)
+---
+
+## Problem
+
+Dorian reports (2026-07-30): the Fedimint gateway app installs with a password already set up — i.e. a default/pre-baked credential rather than one generated at install time or set by the user. Default credentials on a Lightning/fedimint gateway are a security hole: anyone knowing the shipped default can access the gateway. Dorian rated this a blocker.
+
+This also violates the repo's standing secrets invariant (CLAUDE.md): secrets must be manifest-declared (`generated_secrets`, materialised by `container::secrets`, 0600/rootless) — never hardcoded or per-app baked in.
+
+## Solution
+
+Tracked as requirement **FED-07** (Phase 1, ROADMAP success criterion 7 — needs a gap plan since phase 1's 10 plans predate it):
+- Find where the fedimint gateway app's manifest/install path sets its password (check `/opt/archipelago/apps/*/manifest.yml` for the gateway, and the orchestrator's secrets materialisation).
+- Move it to `generated_secrets` so each install gets a unique credential, or require explicit user setup.
+- Migration path for existing installs still carrying the default password (migrations must never destroy data).