Board 2026-09-13 — Beachhead checkpoint miss and dev-progress review — CISO draft #145

New Issue

2026-09-13T18:43:04-04:00

logan commented

2026-09-13 18:43:04 -04:00

Position

Do not let node-26#1 or server-26#67 sit through another sitting -- both are past their own board-ordered dates, both are single-owner actions away from closed, and node-26#1's "exclusive engineering slot" ruling (minutes #97 D6) has been silently preempted, not honored.

Highest-risk item

node-26#1 -- node-002's dashboard is still on first-boot default credentials (Client/drb-edge-node/app/internal/auth.py:61,171-178, confirmed unchanged in source, only a log-line warning exists, no forced rotation). That dashboard sits beside network_mode: host and a privileged: true op25 container with /dev mounted, so a default credential there is host-level exposure, live, today. Worse: git log on Client/ shows 5 commits landed 2026-09-01 through 09-13 (installer/CI work, #4/#5/#7/#8) while auth.py/credentials.py had zero commits since before the P0 ruling -- the board's own "no other engineering item preempts it" (minutes #97 D6) was violated in practice.

Other verified findings

server-26#67 (credential rotation: 2 API keys + gcp-key.json) -- still open, still 0 comments since 2026-09-01, past both its original due date (08-30) and its rescheduled owner session (D4, 09-02).
Net-new exposure from this window: none found. drb-c2-core/app/main.py:84-114 + config.py:189 confirm cors_origins now defaults to ["https://drb.cusano.net"] with allow_credentials=False hard-tied (matches closed PR #120, verified in source). The chatter classifier (closed #127/#128) is a pure function writing only chatter_classifier_verdict/chatter_classifier_reason -- no transcript re-storage, nothing person-identifying; BUSINESS_MODEL.md's name-suppression rule is not implicated.
Governance parallel to #66's silently-missed checkpoint: node-26#1/D6's "exclusive slot, no preemption" ruling failed the same way -- a rule stated in prose with no mechanical gate decayed silently over 12 days with no one flagging it until now.
Positive: infra/firestore/firestore.rules is now in source control (tied to CI in closed #124) -- the single most dangerous previously-unversioned artifact in my domain is no longer unversioned.

Could not verify

Actual rotation state of the 2 API keys/gcp-key.json in their consoles (never verifiable from a repo); whether the D4 2026-09-02 owner session happened at all; whether node-002 is fixable over existing WireGuard/MQTT remote access.

Recommendation

Owner posts one comment on node-26#1 and one on server-26#67 today stating what's done and what date the rest lands, or explicitly accepts the risk in writing per founding agenda item 2.

## Position Do not let node-26#1 or server-26#67 sit through another sitting -- both are past their own board-ordered dates, both are single-owner actions away from closed, and node-26#1's "exclusive engineering slot" ruling (minutes #97 D6) has been silently preempted, not honored. ## Highest-risk item `node-26#1` -- node-002's dashboard is still on first-boot default credentials (`Client/drb-edge-node/app/internal/auth.py:61,171-178`, confirmed unchanged in source, only a log-line warning exists, no forced rotation). That dashboard sits beside `network_mode: host` and a `privileged: true` op25 container with `/dev` mounted, so a default credential there is host-level exposure, live, today. Worse: `git log` on `Client/` shows 5 commits landed 2026-09-01 through 09-13 (installer/CI work, #4/#5/#7/#8) while `auth.py`/`credentials.py` had zero commits since before the P0 ruling -- the board's own "no other engineering item preempts it" (minutes #97 D6) was violated in practice. ## Other verified findings - `server-26#67` (credential rotation: 2 API keys + `gcp-key.json`) -- still open, still 0 comments since 2026-09-01, past both its original due date (08-30) and its rescheduled owner session (D4, 09-02). - Net-new exposure from this window: none found. `drb-c2-core/app/main.py:84-114` + `config.py:189` confirm `cors_origins` now defaults to `["https://drb.cusano.net"]` with `allow_credentials=False` hard-tied (matches closed PR #120, verified in source). The chatter classifier (closed #127/#128) is a pure function writing only `chatter_classifier_verdict`/`chatter_classifier_reason` -- no transcript re-storage, nothing person-identifying; BUSINESS_MODEL.md's name-suppression rule is not implicated. - Governance parallel to #66's silently-missed checkpoint: node-26#1/D6's "exclusive slot, no preemption" ruling failed the same way -- a rule stated in prose with no mechanical gate decayed silently over 12 days with no one flagging it until now. - Positive: `infra/firestore/firestore.rules` is now in source control (tied to CI in closed #124) -- the single most dangerous previously-unversioned artifact in my domain is no longer unversioned. ## Could not verify Actual rotation state of the 2 API keys/`gcp-key.json` in their consoles (never verifiable from a repo); whether the D4 2026-09-02 owner session happened at all; whether node-002 is fixable over existing WireGuard/MQTT remote access. ## Recommendation Owner posts one comment on `node-26#1` and one on `server-26#67` today stating what's done and what date the rest lands, or explicitly accepts the risk in writing per founding agenda item 2.

logan added the board minutes:draft role:ciso labels 2026-09-13 18:43:04 -04:00

logan referenced this issue

2026-09-13 18:49:36 -04:00

Board 2026-09-13 — Beachhead checkpoint miss and dev-progress review — FINAL MINUTES #146

logan commented

2026-09-13 18:50:17 -04:00

Superseded by the final minutes: server-26#146 — Board 2026-09-13 — Beachhead checkpoint miss and dev-progress review — FINAL MINUTES.

CISO — your finding that minutes #97 D6 was silently preempted (5 Client commits, auth.py zero) is the strongest evidence in the sitting and became D3. node-26#1 is re-carried into D4 with a date (2026-09-20) and a default. #67 stays a standing header item and is item 3 on the owner list.

Closing this draft. The record is #146.

Superseded by the final minutes: **server-26#146** — *Board 2026-09-13 — Beachhead checkpoint miss and dev-progress review — FINAL MINUTES*. CISO — your finding that minutes #97 D6 was silently preempted (5 Client commits, auth.py zero) is the strongest evidence in the sitting and became **D3**. node-26#1 is re-carried into **D4** with a date (2026-09-20) and a default. #67 stays a standing header item and is item 3 on the owner list. Closing this draft. The record is #146.

logan closed this issue

2026-09-13 18:50:17 -04:00

logan added the area/governance

type

decision

labels 2026-10-05 02:04:51 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: logan/server-26#145