journal: secrets audit of the cc-ci host; leaked keys found in rsynced agent logs and redacted

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-plan/JOURNAL.md

@@ -1145,4 +1145,29 @@ required `RESUME_PHASE=1` relaunch; the completed phase sequence immediately sto
 
 **Notes:** `cc-ci-plan/launch.py status` is not executable directly in this checkout, so the
   equivalent `python3 cc-ci-plan/launch.py status` was used. The required launch was run via
-  `RESUME_PHASE=1 cc-ci-plan/launch.sh start`; it re-confirmed completion at 16:52:34 UTC.
+  `RESUME_PHASE=1 cc-ci-plan/launch.sh start`; it re-confirmed completion at 16:52:34 UTC.
+## 2026-09-08 17:10 UTC — secrets audit of the cc-ci host (operator asked for a re-verify)
+
+**Result: `/secrets` is exactly what it should be** — 6 files + the inventory README, every one of
+them cross-checked as actually referenced by something on the host:
+`cc-ci.testenv` (GITEA_PASSWORD, DOCKERHUB_*, AUTONOMIC_OPENCODE_KEY), `opencode-auth.json`
+(one provider, `opencode-go`), and two ssh keypairs **generated on this host**
+(`cc-ci-local-ed25519` → `ssh cc-ci`; `autonomic-bot-cc-ci-ed25519` → Gitea, key id 156).
+
+**Proved absent, not just "removed":** the sops **master key** is gone and
+`/var/lib/sops-nix/key.txt` is provably this host's OWN identity (its public half equals
+`ssh-to-age` of the host ssh key: `age1tmvg…`). No tailscale key, no `.netrc`/`.git-credentials`/
+`.aws`/`.npmrc`, no third-party model keys, no inline `apiKey` in any opencode config, and the old
+ZEN key is absent from files, the opencode database and its logs.
+
+**One real finding, fixed.** The agent transcripts I rsynced from the old orchestrator box
+(`/srv/cc-ci/.cc-ci-logs/*.log`, ~145 MB) contained **live credential values in plaintext** — a
+`tskey-auth-…` tailscale key and an older OpenCode ZEN key `sk-iLmK5…` — because earlier sessions
+had pasted the values into logged `grep` commands while running their own secret scans. 133
+occurrences across 7 logs, redacted in place (`<REDACTED-BY-SECRET-SWEEP>`); a whole-host rescan is
+now clean. **Operator: rotate both of those** if either is still live — they sat on a second host.
+Lesson for future sweeps: scanning `/secrets` is not enough, agent logs are a secret sink.
+
+**Legitimately outside `/secrets`** (documented in its README so a later sweep does not "clean"
+them): `/run/secrets/*`, `/root/.docker/config.json`, `/etc/nginx/oc-htpasswd`,
+`/var/lib/ci-certs/live/*.pem`, `/var/lib/sops-nix/key.txt`, `/etc/ssh/ssh_host_*`.