3 Commits

Include renames

Author	SHA1	Message	Date
archipelagoandClaude Opus 5	fda7feda60	security: untrack operations docs; scrub infra identifiers from public docs ... Operations docs move out of git entirely rather than being sanitized. They stay on disk for local use and are gitignored, so the Phase 6 export (which takes HEAD) can never carry them. 15 files: the fleet runbook, hotfix process, node inventories, internal trackers, session handoffs, the key rotation/signing-posture records, and the open-source plan itself. For the docs that remain public, infra identifiers are replaced with things that are better documentation rather than placeholders: curl examples now use `archipelago.local`, the product's own mDNS name, so a reader can run them as-is instead of substituting an address that was never theirs. Deliberately NOT scrubbed, both verified as functional rather than leaked: - `tx1138.com` is the shipped default block explorer (DEFAULT_TX_EXPLORER in useTxExplorer.ts, surfaced in WalletSettingsModal). Product behavior. - `git.tx1138.com` in core/container/{image_policy,registry}.rs is a retired- registry constant the code matches on to strip stale entries from legacy node configs. Removing it would break migration for older nodes. - `192.168.1.254` in bulletproof-containers.md is the LAN gateway in a podman bug description, and `192.168.1.x` in user-walkthrough.md is already generic. Whether a personal domain should be the shipped explorer default in a public product is a separate product question, not a security one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 10:08:18 -04:00
archipelagoandClaude Opus 5	19082a44f0	security: remove node credentials from tracked files (open-source Phase 1) ... Scrubs the fleet SSH/UI password from every tracked file (22 occurrences) and removes inline credentials from the code paths that used them. Docs and trackers keep the surrounding context — these are published under docs/history/ per the open-source plan — with the literals replaced by <FLEET_PW> / <FLEET_PW_ALT> so the "two variants exist" detail survives without the values. Three of the eight files were in .planning/ and were NOT in the plan's enumerated list; the reworked audit-secrets.sh found them. Code changes: - neode-ui/test-openwrt.mjs: node URL and password come from ARCHY_NODE_URL / ARCHY_NODE_PW; the SSH target derives from the URL instead of a hardcoded tailnet IP; exits 2 when unset. - scripts/run-post-install-tests.sh: drops the built-in "testpass123!" default and adds --password-stdin; refuses to run unauthenticated instead of silently trying a known password. --phase1-only still needs no password. - .gitea/workflows/post-install-tests.yml: sshpass with an inline literal replaced by key auth (NODE_SSH_KEY secret); password comes from the NODE_UI_PASSWORD secret and is piped over stdin rather than argv, so it stays out of the node's process list and the job log. Default target IP removed. scripts/audit-secrets.sh now reports 5/5 pass, 0 fail. Note: rotation of the exposed credentials is deliberately deferred to the pre-publish gate and is NOT done by this commit — these values are still live. See Phase 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 09:59:10 -04:00
archipelagoandClaude Fable 5	9221d1bfaf	docs: move 10 finished/historical docs into docs/archive/ with an index ... Session logs, handovers, point-in-time snapshots, the v0.1.0 security audit, stale generated HTML guides, and shipped design docs (three-mode UI, install screens) move out of the living docs/ tree. docs/archive/README.md explains what each was and why it's archived; all in-repo links updated. (docs/UNIFIED-TASK-TRACKER.md links intentionally untouched — it has another agent's uncommitted work in flight.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 17:04:35 -04:00