rdmsm4x-changelog-20260901-2048-phase1-signing-keychain-bus-watcher-hooks

Host: rdmsm4x · Session: claude fleet-health-sync-coordination (27c29282) · Window: 2026-09-01 19:31 → 20:48:58 EDT EDT

One line: seven apps now sign fail-closed with the fleet keychain unlocked per session; the bus converges acks fleet-wide; every agent commit names its harness; a fleet-wide worktree watcher and five new nightly checks are running; the git mirror is under launchd and MATCH; the spoke keychain rollout that prompted Rich is repaired and scripted.

Changes (all commits pushed to git.ecs0.net and GitHub; every commit after 20:20 carries Agent: claude@rdmsm4x)

• Signing, fail closed + fleet_sign_unlock pre-step: updateRoo 602d555/666ac87 · AINetNode 471b987/7bf1367 · rooDB 413416a → (overwritten by af9cba9) → 744cf37 · bookmarkROO 5e15505/be56dd9 · Voight b2afb04/1d1f44f · bitROO 9b9fcf5/08220d1 · Xentropy 849e053/245a146. Each rebuilt; controls: no-identity shim rc=1 + refusal; real rc=0 + TeamIdentifier ZU2882L4HT. Remaining: replicantDB (claude@rdmpw3265m holds).
• Spoke keychains (ISSUE-20260901-19): rdmbair13m5/rdmpw3275m/rdmpw3265m/jdmbair13m5 repaired non-interactively (unlock 0, settings no-flags 0, partition-list 0, probe sign ZU2882L4HT); secret NAME saved on all six hosts; ~/bin/fleet_sign_unlock on all six (fresh-session unlock→sign 5/5); fleet/ops/keysync/fleet_signing_rollout.zsh b01969f (verify 5/5; unknown host fails).
• Bus: agent_msg.zsh v1.3.0 on 6/6 (sha afd35309): .state/ syncs with --update, ack/done push to hub; control: spoke seen-list 33→34→35 with local. fleet/maintenance e563503.
• Git attribution: ~/.agent-coordination/git-hooks + core.hooksPath on 6/6 (sha f769832b); controls: agent env → trailer, env -i → none, repo-local pre-commit still runs. fleet/ops 7260315. (v1.0 shims self-exec'd; fixed with --git-dir.)
• Worktree watcher fleet-wide: worktree_integrity_fleet.zsh v1.1, launchd com.eastcoastscience.worktree-integrity.fleet on rdmsm4x (59 repos) and rdmbair15m5 (9); controls: stale-mtime replacement → CRITICAL, unchanged → none; v1.1 after a 15-min wedge on RDconfTTY (4,886 untracked). fleet/ops 877d6da, e866766. Last pass: [2026-09-01 20:46:20 EDT] pass repos=59 critical=0 scan-failed=0 skipped-bulk=1
• Nightly audit: CHECK 6 ticket doc/CLI conformance (cf1f083), CHECK 7 mirror faithfulness w/ kickstart (6a9b332, 8120ee4), CHECK 8 unattended spoke codesign (6a9b332); each with a negative control run.
• Mirror: pipe-rc trap fixed; com.eastcoastscience.gitmirror every 30 min; verify MATCH 143 repos (4e9a0a0).
• Pointers: FLEET-PROJECT-POINTERS.md generated from the git.ecs0.net store (141 rows, 0 _* or arista), deployed 5/5 (d183157, 0929a02).
• agentkit v1.1: lib/preflight.zsh + 6 tests (c04ba94, a335543), deployed 5/5 (tests 6/6 on each). AGENT_COORDINATION rules 7 (preflight) and 8 (Agent trailer), sha 96f0a3fc on 6/6.
• Tyrell: PermissionHealth.swift restored to HEAD (snapshot 20260901-200300), bundle rebuilt + signed (strict verify 0, universal2, minos 15.0). NOT deployed — owner claude@rdmpw3265m silent since 18:37; all six hosts still on the 08-29 build.
• Tickets: ISSUE-20260901-19 evidence, -20 (_* bares in store), -21 (rooDB template overwrite); ISSUE-13 7/8; ISSUE-20260831-16 claim-check (agy's 'resolved' does not verify); FEAT-59 dataMOB relay; TASK-06 coverage. issues 3efd7e9.
• mem0: 3 memories (fleet signing over ssh; template write-back class + rules 7/8; earlier: fleet mem0 topology, ProcessRunner).

Undo

• Any build.sh: git revert <sha> in that repo. Hooks: git config --global --unset core.hooksPath (do not — rule 8). Watcher: launchctl bootout gui/$(id -u)/com.eastcoastscience.worktree-integrity.fleet. Mirror job: same with com.eastcoastscience.gitmirror. Bus: ~/.agent-coordination/agent_msg.zsh.bak-v1.2.0-20260901 on every host.

Outstanding owner actions

• Rich: Developer ID Application certificate (SEC-20260901-05) — still Apple Development only.
• claude@rdmpw3265m: deploy the clean Tyrell bundle (or release the hold); fix replicantDB build.sh:178/186.
• claude@rdmbair15m5: verify agy commits on LogTTY (ceefc26, active owner) and rdWORKBENCH (6c2a906, frozen); dataMOB GH007 author rewrite before backup push.
• Whoever created ~/git/_archive,_ops,_ops_portfolio: ISSUE-20260901-20.

No secrets in this file.

Addendum 20:52 EDT

• Watcher launchd job: ProcessType Background removed (fleet/ops 4a96476). Under Background the loop completed zero passes in 3.3 min and had wedged 15 min earlier; at standard priority a 59-repo pass logged within ~100 s. state = running was true the whole time — grade launchd jobs by their last-delivery timestamp, never by the state word.