From 83d0744e5872a61019fc3c948408c0bdba879d87 Mon Sep 17 00:00:00 2001 From: Patrick Singletary Date: Sun, 13 Sep 2026 09:24:02 -0400 Subject: [PATCH] docs: add TODO-redteam-2026-08-17 plan --- docs/plans/TODO-redteam-2026-08-17.md | 35 +++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 docs/plans/TODO-redteam-2026-08-17.md diff --git a/docs/plans/TODO-redteam-2026-08-17.md b/docs/plans/TODO-redteam-2026-08-17.md new file mode 100644 index 0000000..aaa5cc5 --- /dev/null +++ b/docs/plans/TODO-redteam-2026-08-17.md @@ -0,0 +1,35 @@ +# TODO — Red-team remediation resume (2026-08-17) + +Repo: ~/dev/_shared (public Tangled, did:plc:gbmu2edwp7u7dva6x62gpgre) +Report (details, findings, scrub list): ~/dev/_shared-redteam/2026-08-17-red-team-report.md — OUTSIDE the repo, read it first +State: history rewritten + verified clean at commit 22ed038; live configs moved to ~/.config/backup3/. + +## [USER] — yours, do when convenient +- [ ] Rotate the Kagi Session Link at https://kagi.com/settings/user_details + (the ONLY server-side kill; token was public ~3 weeks — treat as compromised) +- [ ] Other machine: BEFORE its clone reset — + cp -R ~/dev/_shared/config/backup3 ~/.config/backup3 (from the STALE clone) + git fetch origin && git reset --hard origin/main (plain pull fails on rewritten history) + Studio's launchd backup3 job (60s interval) errors until the configs land. +- [ ] Delete the safety bundle ~/dev/_shared-local/_shared-history-backup-20260817.bundle + when confident the rewrite is good (it contains the OLD token — never sync/share) + +## [HERMES] — needs explicit approval +- [ ] (optional, low value) second filter-repo --replace-text pass to strip the old + id_ed25519_tangled convention from pre-22ed038 history; only bundle with a future rewrite + +## [BOTH] — standing rules +- [ ] ~/dev/_shared-local/ = local-only mirror of removed sensitive files; NEVER git init/push/bundle +- [ ] `git add -A` is forbidden in this repo (AGENTS.md) — stage files by name +- [ ] Live configs live at ~/.config/backup3/ — never commit them + +## Resume prompt (paste into a new chat) + + I'm resuming the red-team remediation of ~/dev/_shared (public Tangled repo). + Read ~/dev/_shared-redteam/2026-08-17-red-team-report.md and + docs/plans/TODO-redteam-2026-08-17.md first. + State: Kagi token + chat logs scrubbed from all history (22ed038); + configs relocated to ~/.config/backup3/; scripts, AGENTS.md, skill library cleaned. + Remaining: rotate the Kagi session link, deploy ~/.config/backup3/ to the other + machine BEFORE its clone reset, delete the safety bundle when confident. + Don't auto-run anything — confirm each step with me. -- 2.51.2