docs(keys): state the acceptable key-placement pattern and the backup-file fix procedure #108

Merged

abiba-bot merged 1 commits from fix/tanko-plaintext-key-in-config-backup-20260916 into master

2026-09-16 11:27:44 +00:00

Author	SHA1	Message	Date
root	9100ea3326	fix: tanko-plaintext-key-in-config-backup-20260916 PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 3s Details PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 5s Details PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 4s Details PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 3s Details PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 1s Details 1. Host-side fix (tanko 192.168.68.122): Moved 5 config.yaml.bak-* files from /root/.hermes/ to /root/hermes-config-backups/ so the scanner pattern no longer matches. Dead credential (sk-b7d99... DEEPSEEK key from July, 401 against gateway) is preserved in history without cluttering the scanned tree. 2. Contract text: Added ACCEPTABLE PATTERN section to hermes-key-enforcement.prose.md clarifying that agent keys live in .env/.env.vault with 600 perms (koonimo's shape), while a plaintext key in config.yaml or any config backup is a violation. Fix procedure: move the backup file out of the scanned tree, don't delete.	2026-09-16 11:16:06 +00:00