rdmbair15m5-changelog-20260916-1100-logtty-and-credential-vault-remediations

Reconciled LogTTY project identity and orphaned edits (TASK-20260901-01), verified 37/37 tests passing, remediated credential vault hook false positive vulnerabilities (SEC-20260905-01), synchronized canonical ticket repository, and reindexed 1,023 tickets into index.sqlite.

1. Scope & Hosts Touched

• Hosts: rdmbair15m5 (local agent), rdmsm4x (canonical dev root and issues authority).
• Repositories Touched:
  • rdmsm4x:~/dev/apps/LogTTY
  • rdmsm4x:~/dev/issues
  • rdmsm4x:~/scripts/cred_vault.py & agent_cred_hook.py (verified)
• Tickets Addressed & Resolved:
  • TASK-20260901-01: LogTTY orphaned uncommitted edits & universal purchase identity reconciliation.
  • SEC-20260905-01: Credential vault hook writes false positives into ~/.secrets/global.env.

2. Changes Implemented & Verifications

A. LogTTY Reconciliation (TASK-20260901-01)

• Problem: Stale backup file Apps/LogTTYMobile/LogTTYMobile.xcodeproj/project.pbxproj.bak-20260831 was tracked in git, creating a latent risk of reverting the universal purchase bundle identifier (com.eastcoastscience.LogTTY) to .mobile.
• Remediation:
  • Untracked and deleted Apps/LogTTYMobile/LogTTYMobile.xcodeproj/project.pbxproj.bak-20260831 in commit 90896b9.
  • Pushed commit 90896b9 to both fleet (git.ecs0.net:git/apps/LogTTY.git) and backup (github.com/richhdoty/rdmsm4x-dev-apps-logtty.git).
• Empirical Verification:
  • Executed ./script/verify_product_identity.sh -> exit code 0 (logTTY current-product identity: PASS).
  • Executed swift test on rdmsm4x -> exit code 0; 37 tests across 10 suites passed in 7.37s with 0 failures:
    • privileged helper lifecycle: 6 tests passed.
    • privileged helper system log loader: 2 tests passed.
    • bounded system OSLog query: 4 tests passed.
    • live unified-log stream collector: 3 tests passed.
    • consent-gated desktop collection worker: 6 tests passed.
    • persistent Direct system collection consent: 4 tests passed.
    • live stream is bound to the same Direct consent gate: 1 test passed.
    • application-owned local collection: 2 tests passed.
    • live unified-log stream collector - end to end: 1 test passed (3.14s).
    • live stream source delivers real volume: 8 tests passed (2.09s).
  • Verified SocketLogCorrelator.swift and SocketLogCorrelatorTests.swift are committed and active (c3c159e).

B. Credential Vault Hook False Positives Remediation (SEC-20260905-01)

• Problem: Hook agent_cred_hook.py previously matched arbitrary text patterns in prompts and shell commands (e.g. CPU usage:..., SRC=${VAR:-default}..., export CACHE_KEY=...) and appended _SECRET, polluting ~/.secrets/global.env.
• Remediation:
  • Gated capture in cred_vault.py with strict regex and semantic checks: CRED_NAME_RE, NAME_SUFFIX_DENY, NAME_DENY (denying CACHE_KEY, SORT_KEY, etc.), _PATHY_RE, _FLAGGY_RE, _URLY_RE, _SHELLY_RE, _VARREF_RE, _NUMERIC_RE, _DATEY_RE, _FILE_EXT_RE, and PLACEHOLDER_MARKERS.
  • Hardened agent_cred_hook.py with write_to_env=False and VAULT_AUTOWRITE=False so hook execution never mutates global.env automatically.
  • Confirmed false-positive entries (CPU_SECRET and SRC_SECRET) are completely absent from ~/.secrets/global.env.
• Empirical Verification:
  • Tested cred_vault.py scan against false positive string (CPU usage: 14.7 percent user; SRC=${VAR:-default}/foo/bar; export CACHE_KEY=12345678) -> exit code 0, detected: [] (count: 0).
  • Tested cred_vault.py scan against genuine vendor token (export GITHUB_TOKEN=ghp_...) -> exit code 0, correctly detected and redacted (count: 1).
  • Grepped ~/.secrets/global.env for CPU_SECRET and SRC_SECRET -> exit code 1 (clean, absent).

C. Issue Tracker & Fleet Sync

• Resolved TASK-20260901-01 (commit 01387cd).
• Resolved SEC-20260905-01 (commit 540e994).
• Pushed commits to git.ecs0.net:git/dev/issues.git and github.com/richhdoty/rdmsm4x-dev-issues.git.
• Reindexed tickets via ticket reindex -> 1,023 tickets indexed into /Users/richh/dev/issues/index.sqlite and HTML dashboards regenerated at /Users/richh/Desktop/issues/tickets/ and /Users/richh/dev/sites/dev.ecs0.net/wiki/issues/.

3. Outstanding Owner Actions

• None. All tasks and verifications were fully executed and tested.