rdmpw3275m-changelog-20260923-1750-xentropy-full-key-history-home-scan

rdmpw3275m - changelog - XEntropy full key history and home scan - claude - xentropy 0.3.0 release - Xentropy - 20260923-1750

Session: 2026-09-23 14:41:54 EDT to 2026-09-23 17:50 EDT Ran on: rdmpw3275m · Changed state on: rdmsm4x (canonical XEntropy repo, one staged secrets file), rdmpw3275m (scratch worktrees only)

XEntropy 0.3.0 (3) is merged into canonical main and pushed. It shows every API key with its full rotation history, scans the whole home folder plus Apple Notes, and has a redesigned full-window Credentials table. It is built and tested but NOT installed on any Mac yet: code signing over SSH failed.

Scope

Source only: rdmsm4x:~/dev/apps/Xentropy, main fast-forwarded caf72e8 → 1feeb91, pushed to fleet, origin, backup (all 0/0).
No install, no runtime change on any Mac. Every host still runs 0.2.0 (2).
No provider mutation. No change to any global.env. No project credential files touched on any host.
Left alone: lib/ecs0lib (read only, bccac9b), the shared ecs_sign_notarize.zsh, and the running XEntropy app.

Files created

Path	What
`app/Sources/XEntropyCore/CredentialSighting.swift`	Shared sighting, HMAC fingerprint and masked-preview contract
`app/Sources/XEntropyCore/OwnerSecretStoreHistory.swift`	Reads all of `~/.secrets` incl. archives and commented lines, values-free
`app/Sources/XEntropyCore/CredentialInventory.swift`	Groups sightings into keys and versions (current, previous, unmanaged)
`app/Sources/XEntropyCore/CredentialScanScope.swift`	Home-aware include and exclude rules
`app/Sources/XEntropyCore/AppleNotesDiscovery.swift`	Apple Notes reader (osascript JXA)
`app/Sources/XEntropy/APIKeyRegistry{Support,Components,Inspector}.swift`	New Credentials screen parts
`rdmsm4x:~/.secrets/staging-20260923/cloudflare-mute-mouse-c177.env`	Owner-supplied rotated Cloudflare token, mode 0600, staged only
`rdmpw3275m:~/dev/_worktrees/xentropy-claude-20260923/`	Scratch clone and two worker worktrees

Files modified

Discovery engine, CLI, app screens, tests: see commits 2846ee3 c542b15 41d9b8c 92725e8 5c7ff32 dad1b03 8db9538 f618ba0 6e3b040 5b4dd89 a550ade 78a9407 1feeb91.
entitlements/XEntropy.entitlements: fleet and Developer ID profile no longer sandboxed; apple-events only (DEC-20260923-01).
build.sh, scripts/install_xentropy_local_instance_v1.0.zsh, scripts/verify_xentropy_fleet_canary_v1.0.zsh: 0.3.0 (3), plus NSAppleEventsUsageDescription.
CLAUDE.md (rewritten via /init), DECISIONS.md, README.md, SESSION-STATE.md, ISSUES.md, CHANGELOG.md.
Backup: git history (all three remotes hold caf72e8).

Commands run

swift build --package-path app ; swift test --package-path app          # rdmpw3275m
git merge --ff-only fleet/claude/xentropy-full-history-20260923          # rdmsm4x main
git push fleet|origin|backup main
zsh scripts/install_xentropy_local_instance_v1.0.zsh --dry-run --host rdmpw3275m   # DRY_RUN_OK
zsh scripts/install_xentropy_local_instance_v1.0.zsh --host rdmpw3275m             # failed at codesign

Verification performed

Merged tree: 435 XCTest (434 passed, 1 skipped env-gated snapshot test) plus 4 Swift Testing, 0 failures. Baseline 361.
Remotes read back after push: fleet/main, origin/main, backup/main equal main.
Installed app on rdmpw3275m re-read after the failed install: 0.2.0 (2), binaries dated 2026-09-05. The install did not reach the host.
New screen checked only in offscreen snapshots with synthetic data (1180 and 1500 pt, light and dark).
Real-data counts only on rdmpw3275m: 12 keys and 13 versions from the owner store, where the old screen showed 6 aliases. The whole-home scan covered 230,889 files in 159 s.

How to undo

# Code: revert the release on main (no install happened, so nothing to roll back on any Mac)
git -C ~/dev/apps/Xentropy revert --no-edit -m 1 a550ade   # and the other listed commits as needed
# Staged token: move it aside, never delete
mv ~/.secrets/staging-20260923 ~/.secrets/archive-20260923-staging

Secrets

No value in this changelog, in any commit, or in any doc.
The owner pasted a rotated Cloudflare token into the session. It is stored only in rdmsm4x:~/.secrets/staging-20260923/cloudflare-mute-mouse-c177.env (0600). It is not merged into global.env and was not propagated anywhere. The value is also in this session's local transcript.