chore(todo): file the secrets-repo hardening and its follow-upsHEADmain

I filed the task to move secrets out of the shareable dotfiles repo into a private store delivered via a personal ISO, with the rotation and reconcile work it depends on. The design detail and the incident record stay in a local unpublished doc, not this public repo. I also stamped the two settled network-panel decisions: metered detection and saved-connection ordering.

1 files changed, 50 insertions, 4 deletions

diff --git a/todo.org b/todo.org
index 68f790d..d9629ba 100644
--- a/todo.org
+++ b/todo.org
@@ -45,6 +45,26 @@ below):
   input-side-spec.org (DRAFT, four decisions open).
 
 * Archsetup Open Work
+** TODO [#A] Move secrets out of public dotfiles → private repo + combined personal ISO :feature:security:dotfiles:
+:PROPERTIES:
+:CREATED: [2026-08-11 Tue]
+:LAST_REVIEWED: 2026-08-11
+:END:
+Structural fix for the root cause behind both 2026-08-09/10 leaks: secrets live
+in the *public* dotfiles repo and rely on in-place encryption, which two commits
+defeated. Design agreed with Craig and tabled before build 2026-08-11. Full
+detail + the pickup point are kept LOCAL (they map the setup, so not in this
+public repo):
+=.ai/private-design/2026-08-11-secrets-repo-and-combined-iso.org=.
+Shape in one line: move secrets to a private, off-public-scan-path repo, keep
+them encrypted even there (defense in depth), and deliver them to a fresh
+install as an encrypted bundle baked into a *personal* ISO — riding the combined
+archangel+archsetup ISO that's already ~80% built. Two ISO modes: generic
+(shareable) vs personal (encrypted secrets, private).
+[#A] because it closes a live-leak class, but *gated on the rotation VERIFY* —
+don't start the migration until the credentials are rotated. Not started.
+Not :solo: — repo standup and history rewrite are Craig's calls; promote to a
+real spec (spec-create) when work resumes.
 ** VERIFY [#A] Pre-vacation fix list — morning review
 SCHEDULED: <2026-08-08 Sat>
 :PROPERTIES:
@@ -420,12 +440,38 @@ Craig, 2026-07-21 ("mind. blown."): drive the Dupre Night Watch screensaver (doc
 :LAST_REVIEWED: 2026-08-02
 :END:
 Craig, 2026-07-21: the wlogout window (Super+Shift+Q — lock/reboot/shutdown/logout/suspend/hibernate) "isn't great and has bugs." Review it end to end: catalogue the specific bugs, then assess the design against the Dupre instrument-console family (it predates the panel aesthetic). Config lives in dotfiles; the bind is hyprland.conf:428 (=pgrep -x wlogout || wlogout-menu=). Context: the desktop-settings panel spec withdrew lock/suspend in favor of this screen (2026-07-21 amendment), so it's now the sole owner of session-exit actions — worth being good. Grade each bug found via the severity×frequency matrix; this parent stays a [#C] review until specifics emerge.
-** TODO [#B] Audit cgit-published repos for secrets and privacy :bug:security:
+** TODO [#A] Audit cgit-published repos for secrets and privacy :bug:security:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-21
+:LAST_REVIEWED: 2026-08-09
 :END:
-Grading: security carve-out — cgit at git.cjennings.net serves every repo under scan-path=/var/git over unauthenticated https (any repo is anonymously cloneable). archsetup being public is by design (curl-install), but this means ANY secret in ANY /var/git repo is world-readable, and any repo meant to be private is not. Severity depends on what else lives there = P2 = [#B], raise if a private repo with secrets is found.
-Not :solo: — needs Craig's decisions. Steps: list repos under /var/git; for each, decide intended public vs private; scan each for secrets (keys, tokens, credentials) the way this WireGuard leak was found; for any meant-to-be-private repo, actually restrict access (cgit repo.hide only hides from the index — a known repo name is still cloneable; use http auth or move it off the public scan-path); for public repos, confirm no secrets and add a pre-receive/CI secret scan. Check dotfiles (git.cjennings.net/dotfiles) specifically — it is also under /var/git. archsetup's own move is decided and tracked separately below.
+Grading: security carve-out — cgit at git.cjennings.net serves every repo under scan-path=/var/git over unauthenticated https (any repo is anonymously cloneable). Raised [#B] → [#A] on 2026-08-09: the scan found a real live-credential leak (below), so this is now a confirmed exposure with an open rotation blocking, not a hypothetical. Drops back to [#B] once rotation is done and the visibility rulings are made.
+Not :solo: — needs Craig's decisions and the credential rotation. Steps: list repos under /var/git; for each, decide intended public vs private; scan each for secrets (done, below); for any meant-to-be-private repo, actually restrict access (cgit repo.hide only hides from the index — a known repo name is still cloneable; use http auth or move it off the public scan-path); for public repos, confirm no secrets and add a pre-receive/CI secret scan. archsetup's own move is decided and tracked separately below.
+*** VERIFY [#A] Rotate the credentials exposed by the 2026-08-09 dotfiles leak
+SCHEDULED: <2026-08-10 Mon>
+A plaintext credential file was briefly public in the dotfiles repo and was
+confirmed pulled by an external crawler before the purge, so every credential
+in it must be rotated. Full list, forensic detail, and the remediation record
+are kept LOCAL, not in this public repo:
+=.ai/private-design/2026-08-09-cgit-secrets-audit.md=. A second, low-severity
+unencrypted token was also exposed and needs a re-auth + purge (same doc).
+Craig's action; the purge only stopped further copies. Desktop alarm set
+(=at= job 61, 15:00) as the backup nudge.
+*** 2026-08-09 Sun @ 12:05:00 -0500 Found + purged a public plaintext-credential leak
+A file that looked encrypted by its name was plaintext in one commit; a
+second, content-verifying triage caught it. Purged from history in both repos
+(the shareable dotfiles and this one) and reconciled the local clones; a fresh
+anonymous clone no longer serves it. Everything else the audit flagged was
+benign. The forensics, exact mechanism, and remediation steps are in the local
+doc above (not published, since they map the setup). Follow-ons: the rotation
+VERIFY above, velox reconcile on return, the secrets-repo split (top of Open
+Work), the wireguard =.gitignore= bug (line ~191), the cgit move (below), and a
+pre-receive secret-scan hook so this can't recur.
+*** TODO [#B] velox: reconcile its clones after the history rewrite
+velox was offline for repair during the 2026-08-09 purge, so its clones still
+hold the pre-rewrite history and are diverged from the rewritten remotes. On
+its return: force-fetch + rebase local work onto the rewritten main in both
+repos (or re-clone), force-update the local tag, local-gc, before its next
+push. Also on the velox riders on the sleep/suspend task.
 ** TODO [#B] Move archsetup off cgit to cjennings@cjennings.net :chore:security:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-21