rdmpw3275m-changelog-20260924-0210-xentropy-030-shipped-fleet-and-consolidation-prd

rdmpw3275m - changelog - XEntropy 0.3.0 shipped to six Macs plus consolidation PRD and audit tool - claude - FEAT-20260924-01 - Xentropy - 20260924-0210

Session: 2026-09-24 01:10:59 EDT to 2026-09-24 02:10 EDT (continuation of the 2026-09-23 14:41–17:50 session) Ran on: rdmpw3275m · Changed state on: all six Macs (XEntropy install), rdmsm4x (canonical repo, PROJECTS.md, project-docs JSON, dev.ecs0.net wiki, tickets), rdmpw3275m (audit outputs, discovery index)

XEntropy 0.3.0 (3) is installed, hash-verified and running on all six Macs. The blocker was the installer's codesign resolving to a locked duplicate identity over SSH; fixed by pinning the keychain. A consolidation/passkey-audit PRD (95 sources), six mock UI flows, a PRD index and a working owner audit script are merged on the fleet branch, and two pages are published for Rich.

Scope

Fleet install via scripts/install_xentropy_local_instance_v1.0.zsh from rdmsm4x at commit f8d3f51; app launched in each console session; verify --all ARTIFACT_PASS on every host across two runs (one Tailscale flap per run; jdmbair13m5 verified directly).
On rdmsm4x: 15 stale XEntropy.app copies under dist/, _handoff/, _inbox/, _fleet-intake-*, _migration/ renamed *-retired-20260924 (moved, not deleted) so LaunchServices only registers ~/Applications/XEntropy.app. One mis-moved empty dir (~/Library/Application) was restored within the same minute.
Left alone: provider credentials (no rotation), global.env on every host, the staged Cloudflare token, lib/ecs0lib.
Peer session claude@rdmsm4x (xentropy-fb) owns: discovery-count honesty, LiteLLM lane retirement, 0.3.1 (4) cut and rollout (main 985a936).

Files created

Path	What
`apps/Xentropy/scripts/credential_audit.py`, `credential_audit.zsh`, `scripts/tests/test_credential_audit.py`	Owner credential/passkey audit tool, 23 tests
`apps/Xentropy/docs/product/PRD-credential-consolidation-and-passkey-audit.md`	New PRD, 95 sources fetched 2026-09-24, UNVERIFIED list in §10
`apps/Xentropy/docs/design/consolidation-flows.html`	Six mock screens, synthetic data
`apps/Xentropy/docs/product/PRD-INDEX.md`	Every PRD with status and built-vs-pending
`~/dev/data/project-docs/screenshots/Xentropy-observatory-030-20260924-0130.png` (rdmsm4x)	Observatory capture, values hidden
`~/Library/Application Support/XEntropy/Audit/{credential-audit.sqlite3,credential-audit-report.html,credential-audit.csv}` (rdmpw3275m, 0600)	Values-free audit outputs
`~/.claude/projects/-Users-richh-dev/memory/codesign-over-ssh-pin-keychain.md`	Memory: the codesign root cause
Published pages	Ship status https://claude.ai/artifact/6TFBo9epkwX2a4SQVoVovB · Mock flows https://claude.ai/artifact/KjVRPhcqZGPv3e4a4ANKzj (private to Rich)

Files modified

scripts/install_xentropy_local_instance_v1.0.zsh — codesign pinned to fleet-signing.keychain-db (f8d3f51, on main).
CLAUDE.md, STATUS.md, SESSION-STATE.md, ISSUES.md, CHANGELOG.md — ship state, root cause, PRD findings, decisions for Rich, Cloudflare consumer map (21b4f36 on main; a309b13 on branch claude/xentropy-full-history-20260923, fleet remote, pending fast-forward after the peer's 0.3.1 rollout).
rdmsm4x:~/dev/PROJECTS.md XEntropy row; rdmsm4x:~/dev/data/project-docs/Xentropy.json; dev.ecs0.net wiki rebuilt (publish_dev_ecs0.zsh).
~/Applications/XEntropy.app, ~/.local/bin/xentropyctl on six Macs → 0.3.0 (3). Backup: installer rollback dirs ~/Library/Application Support/XEntropy/DeploymentRollback/20260924-* on each host.
rdmpw3275m:~/Library/Application Support/XEntropy/Discovery/credential-observations-v1.json — replaced by a schema-2 whole-home index (231,874 files, 24,592 findings).

Commands run

zsh scripts/install_xentropy_local_instance_v1.0.zsh --host rdmsm4x            # then the other five; jdmbair13m5 on retry
zsh scripts/verify_xentropy_fleet_canary_v1.0.zsh --all                        # two runs
~/.local/bin/xentropyctl discovery scan                                        # rdmpw3275m, 227 s
uv run --with pytest --with cryptography pytest -q scripts/tests               # 23 passed
python3 scripts/credential_audit.py scan --json ; audit --json                 # counts only
git merge --no-ff claude/xentropy-credential-audit-script ; claude/xentropy-consolidation-prd ; origin/main

Verification performed

Installed version read back on every host (plutil 0.3.0 / 3); exact SHA-256 of app and CLI matched the release manifest; codesign --verify --strict; lipo -archs = x86_64 arm64; process present in the console session on all six; on rdmsm4x a 1507×1044 window listed by CGWindowList.
Tests: 435 XCTest + 4 Swift Testing, 0 failures on the merged tree (from the 17:41 EDT run); audit script 23/23.
Real audit on rdmpw3275m: 2,562 Apple Passwords accounts, 143 passkeys (106 active), 54 findings; report rendered headlessly and inspected.
Mock flows page rendered headlessly (light and dark) and inspected before publishing.

How to undo

# Per host: the installer's rollback record (manifest-restorable)
ls ~/Library/Application\ Support/XEntropy/DeploymentRollback/     # pick the 20260924-* entry and follow docs/runbooks/xentropy-vnext-deployment-recovery.md
# rdmsm4x stale bundles: rename back
for d in $(find ~/dev -maxdepth 6 -name 'XEntropy.app-retired-20260924'); do mv "$d" "${d%-retired-20260924}"; done
# Docs: git revert 21b4f36 / a309b13 on the branch

Secrets

No value in this changelog, the commits, the pages or the docs. The audit tool wrote only fingerprints/metadata; plan-apple (which writes values) was never run.
The rotated Cloudflare token remains only in rdmsm4x:~/.secrets/staging-20260923/cloudflare-mute-mouse-c177.env (0600), unapplied.