rdmbair15m5-changelog-20260830-1315-fleet-ssh-automation-audit-and-profile

Audited six-host SSH Automation permissions, avoided a destructive global TCC reset, and prepared a narrow Apple Business PPPC profile for the four requested receiver apps.

Scope

• Audit/control host: rdmbair15m5
• Read-only fleet probes: rdmsm4x, rdmpw3265m, rdmpw3275m, rdmbair13m5, rdmbair15m5, jdmbair13m5
• Attempted narrow TCC reset: rdmpw3275m, rdmbair13m5
• Successful local configuration changes on remote hosts: none
• Local artifact changes: rdmbair15m5 only

Files touched

• /Users/richh/Documents/Codex/2026-08-30/fix/work/audit_tcc_automation_fleet_v1.0.zsh
• /Users/richh/Documents/Codex/2026-08-30/fix/outputs/fleet-ssh-automation-permissions-report-2026-08-30.md
• /Users/richh/Documents/Codex/2026-08-30/fix/outputs/dataroo-sshd-appleevents-four-targets.mobileconfig
• /Users/richh/Documents/Codex/2026-08-30/fix/work/rdmbair15m5-changelog-20260830-1315-fleet-ssh-automation-audit-and-profile.md
• Secondary archive created by the Notes changelog tool: /Users/richh/dev/LLM/Claude/changelogs/rdmbair15m5-changelog-20260830-1315-fleet-ssh-automation-audit-and-profile.md

Commands and actions

• Resolved the live host with scutil --get ComputerName and confirmed an Aqua desktop session.
• Read the fleet coordination policies and the macOS log-triage instructions.
• Ran a byte-verified preserved copy of audit_codex_fleet_topology_v1.0.zsh from canonical rdmsm4x; the documented canonical script path was absent.
• Queried profiles status, installed PPPC payloads, managed Remote Apple Events restrictions, code-signing requirements, tccutil state where supported, process/session state, and bounded TCC unified logs.
• Ran four bounded Apple Events probes through incoming SSH on all six hosts: Notes count, Finder startup-disk name, System Events process count, and Terminal window count.
• Attempted tccutil reset AppleEvents com.apple.sshd-keygen-wrapper on rdmpw3275m and rdmbair13m5; both returned OSStatus -10814, so no reset occurred.
• Did not run the broader tccutil reset AppleEvents, because it would remove unrelated working grants.
• Checked Apple Business in a temporary browser tab; it stopped at the sign-in page. No credentials were entered or inspected and no external configuration was created.
• Validated the prepared .mobileconfig using plutil -lint and xmllint --noout.
• Ran the installed notes_changelog.zsh; it wrote an extra normalized record to llmlog and did not create the promised archive copy because its local v1.2 behavior diverges from the current per-host rule.
• Added the required exact archive copy and host-scoped Apple Notes record explicitly; preserved the extra llmlog record rather than deleting it.

Verification evidence

• All six SSH destinations returned the expected ComputerName and were reachable.
• /usr/libexec/sshd-keygen-wrapper passed code-sign verification on all six hosts with requirement identifier "com.apple.sshd-keygen-wrapper" and anchor apple.
• Notes, Finder, System Events, and Terminal receiver requirements matched across all six hosts.
• rdmsm4x and rdmbair15m5 passed all four real SSH-launched Apple Events probes.
• rdmpw3265m and jdmbair13m5 passed System Events but not the other three targets.
• rdmpw3275m and rdmbair13m5 passed none of the four target probes.
• Post-attempt probes on rdmpw3275m and rdmbair13m5 matched pre-state, confirming the rejected reset made no change.
• Report SHA-256: e9a9c4442908c4089114ec505fdb809550bbee52b8c2f6595977ba2e63145648.
• Profile SHA-256: 1190a8fe7de414381c8471b1de11bd1241253e493d6be151c515b49d3c7e9e5a.
• Correct rdmbair15m5 Notes folder record: one matching body/title read back; Notes visibly truncates the long displayed name with an ellipsis.

Backups and recovery

• No TCC database backup was made: the user database is protected by macOS, and no supported narrow reset succeeded.
• The pre-state and post-attempt results are preserved in the report.
• The profile was not uploaded, assigned, or installed, so it has no deployed-state rollback requirement.
• To undo the local artifact creation, remove the report, profile, audit helper, and this changelog after preserving any desired copy. Do not remove any deployed profile because none was deployed in this run.

Outstanding owner action

• Sign in to Apple Business, upload the prepared Custom Configuration, review its one sender and four receivers, assign it to the six-Mac Blueprint/collection, wait for per-host installation evidence, and rerun the incoming-SSH probes.
• Reconcile the pre-existing topology audit drift for rdmpw3265m and jdmbair13m5 separately; it was observed but not changed here.