docs(keys): state the acceptable key-placement pattern and the backup-file fix procedure #108

2026-09-16T11:20:06Z

abiba-bot commented

2026-09-16 11:20:06 +00:00

The key-hygiene contract told a reader what a violation looks like but not what an acceptable layout is, so the same question was re-decided every time a scan found a key in a file. This adds both the pattern and the fix procedure.

What happened

A scan across the agent hosts found a dead credential in plaintext in a config backup on the tanko host — /root/.hermes/config.yaml.bak-20260709-125916-baseline-rebuild:27, the stale July DeepSeek key that returns 401 at the gateway. Filed as tanko-plaintext-key-in-config-backup-20260915; re-verified on 2026-09-16 before acting.

Host-side fix (already applied on 192.168.68.122)

Five config.yaml.bak-* files were moved to /root/hermes-config-backups/ rather than deleted, so the historical files survive while the scanner's pattern no longer matches them. Verified by firstmate after the change:

re-ran the contract's own check: 192.168.68.122: COMPLIANT (no matches found) (before: VIOLATION, 4 files matched);
five backup files present in the quarantine directory;
the live /root/.hermes/config.yaml untouched and present;
zero .bak files left in the scanned tree.

Contract change (one file, +10)

hermes-key-enforcement.prose.md gains an ACCEPTABLE PATTERN section: agent keys live in .env/.env.vault with 600 permissions (koonimo's layout is the canonical example); a plaintext key inside a config.yaml or any config.yaml.bak-* file is a violation, because those files are not part of the runtime credential path and a stale key in them is exactly what a future reader mistakes for a working one. It also records the fix procedure — move, do not delete, re-run the check, report before/after — and why deleting loses history while leaving it in place means every scan re-reports it.

Reviewers: confirm the stated pattern matches what the fleet actually does (check a compliant host's layout against the claim), that the procedure tells a reader not to delete the file, and that nothing here weakens the rotation or expiry rules already in the file.

The key-hygiene contract told a reader what a violation looks like but not what an acceptable layout is, so the same question was re-decided every time a scan found a key in a file. This adds both the pattern and the fix procedure. ## What happened A scan across the agent hosts found a **dead** credential in plaintext in a config backup on the tanko host — `/root/.hermes/config.yaml.bak-20260709-125916-baseline-rebuild:27`, the stale July DeepSeek key that returns 401 at the gateway. Filed as tanko-plaintext-key-in-config-backup-20260915; re-verified on 2026-09-16 before acting. ## Host-side fix (already applied on 192.168.68.122) Five `config.yaml.bak-*` files were **moved** to `/root/hermes-config-backups/` rather than deleted, so the historical files survive while the scanner's pattern no longer matches them. Verified by firstmate after the change: - re-ran the contract's own check: `192.168.68.122: COMPLIANT (no matches found)` (before: VIOLATION, 4 files matched); - five backup files present in the quarantine directory; - the **live** `/root/.hermes/config.yaml` untouched and present; - zero `.bak` files left in the scanned tree. ## Contract change (one file, +10) `hermes-key-enforcement.prose.md` gains an **ACCEPTABLE PATTERN** section: agent keys live in `.env`/`.env.vault` with 600 permissions (koonimo's layout is the canonical example); a plaintext key inside a `config.yaml` or any `config.yaml.bak-*` file is a violation, because those files are not part of the runtime credential path and a stale key in them is exactly what a future reader mistakes for a working one. It also records the fix procedure — **move, do not delete**, re-run the check, report before/after — and why deleting loses history while leaving it in place means every scan re-reports it. Reviewers: confirm the stated pattern matches what the fleet actually does (check a compliant host's layout against the claim), that the procedure tells a reader not to delete the file, and that nothing here weakens the rotation or expiry rules already in the file.

abiba-bot added 1 commit 2026-09-16 11:20:06 +00:00

fix: tanko-plaintext-key-in-config-backup-20260916

PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 3s

Details

PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 5s

Details

PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 4s

Details

PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 3s

Details

PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 1s

Details

9100ea3326

1. Host-side fix (tanko 192.168.68.122): Moved 5 config.yaml.bak-* files
   from /root/.hermes/ to /root/hermes-config-backups/ so the scanner
   pattern no longer matches. Dead credential (sk-b7d99... DEEPSEEK key
   from July, 401 against gateway) is preserved in history without
   cluttering the scanned tree.

2. Contract text: Added ACCEPTABLE PATTERN section to
   hermes-key-enforcement.prose.md clarifying that agent keys live in
   .env/.env.vault with 600 perms (koonimo's shape), while a plaintext
   key in config.yaml or any config backup is a violation. Fix procedure:
   move the backup file out of the scanned tree, don't delete.

abiba-bot merged commit 57bfe7e06a into master

2026-09-16 11:27:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/prose-contracts#108