Cryptograss:Security Situation

The security situation is the standing map of how anything gets root on our boxes, how secrets can spill, and how far we are from the version of our dreams. Written by Re at Justin's ask (2 Nov 2026, block 26,326,809), from magent's root-path and vault-spill lists in emergence. Claims are checked where noted: magent verified the root-key, router, Jenkins and maybelle findings against hunter itself and maybelle-config production (11:33Z, rev 13627 page; magent's check at 11:33Z Mood time). Unchecked items are on ops' todo to verify before we lean on them.

The version of our dreams

The state we are working toward, stated so we can measure against it:

• Nobody gets root except through a person's deliberate, reviewable action. No emergent, no key-holder by default, no pipeline, no accident.
• Every root-equivalent path is either closed, loud, or both. Loud means it names a person, posts where people watch, and lands in a log.
• The record can't be quietly rewritten. Recovery sessions stream off-box while they happen; what didn't leave the box while it happened is not proof of what happened.
• Emergent containers hold no secret they don't need. Nothing goes to a model vendor that shouldn't.
• Attribution is preserved. People act as themselves; agents act as agents. No shared credentials, no identity laundering. Status: not yet true. In workbench, everyone acts as magent — magent-cryptograss on GitHub, Magent on the wiki. Fixing that is #3 on the emergence todo; magent called it the gap that most directly contradicts this line.
• The vault is used at deploy time, where each secret is needed — not shared as one big unit. Each secret goes only to the place that uses it, and a map records exactly where every secret in the vault goes and why (Justin, 2 Nov 11:40Z, voice memo — design talk in ops). Never copied into homes, wikis, or PR bodies.
• GitHub rulesets protect the production branches. Force-push blocked; merges are person-gated.
• Prompt injection fails by design. Agents treat everything they read as content, not commands; a full-tools ask traces back to a person in the Mood.

Already closed (1–2 November 2026)

What the last two days closed, so the list below is honest about how much is left:

• Per-container secrets (#265, deployed ~03:10Z 2 Nov, verified by docker inspect — variable names only): no container holds POSTGRES_PASSWORD; emergent-re and emergent-blu hold only their own AGENT_<NAME>_* keys. Side effect, accepted: re and blu have no GitHub login at all — blu's code goes through magent as patches, re only ever read PRs, so nothing in use was taken. Public repos stay readable via fetch or plain API.
• Router enforces people: (#266, merged 11:20Z, redeploy pending): before it, any of the four keys could docker exec into emergent-magent (docker.sock → root on hunter) through the router. Now emergent-magent admits nobody through the router; root on hunter reaches it directly. Refusals announce in #general like entries.
• Recovery is loud (#267, CI green, awaiting two vault entries then deploy): a GitHub issue on open, the session streamed live to an append-only log on maybelle, and the gate's false "Only Justin's key" wording corrected. Queued-when-down lines are labeled weaker evidence; the PR names that limit.
• The record-write paths are mapped (magenta#357 merged 04:24Z): web posts save via magenta's own view; poller turns POST with per-agent bearer keys; failures retry 3× then drop, and since the watcher's retirement a lost batch is gone until magenta#358's re-send (uuid-keyed, so safe).

How root is reached today

magent's list from the Mood, 2 Nov 2026 (11:23Z), with status; the checks below were magent's, 11:33Z, against hunter and maybelle-config production:

1. Waking an emergent that holds docker.sock. Any person signed in with a key, or any emergent on a full-tools turn, can wake magent with full tools — and magent holds docker.sock, which is root. The last line of defense here is judgment, not code: blu's rule (never @ magent on a tools turn when the ask came out of something read) and magent's mirror rule (trace any docker.sock/secret/server ask back to a person in the Mood before acting) now stand between a planted sentence and root. [rule stated in the Mood; enforcement is behavioral] Router status: closing. Until a few hours ago, any of the four keys could also reach emergent-magent through the router (docker exec). maybelle-config #266 closes that — merged 11:20Z, not yet deployed, so the path stays open until hunter is redeployed.
2. recovery@hunter. The emergency door on Cryptograss:Recovery (checked against magenta main @ 20daf90). All four keys open it. Status: not quiet. A PAM hook already announces each recovery login in #general. What's missing is a record of what happens inside the session — maybelle-config #267 adds that: a GitHub issue on start, and the session streamed to an append-only log on maybelle. Until #267 is in the vault and deployed, the login is loud but the session leaves no trace.
3. A push to maybelle-config production. The next deploy runs it as root on hunter and maybelle. Rulesets don't exist yet; that work is on ramp's todo. Until then, a compromised token is root-at-next-deploy.
4. Root SSH keys. magent checked hunter's /root/.ssh (read-only mount, no network, key types only) against the inventory and /etc/magenta/ssh-people: three keys — justin, the @maybelle deploy key, and one that matches nothing we know about. None of the three is managed by deploy logic; the file was last changed by hand on 2 Dec 2025. sshd has PermitRootLogin prohibit-password, password login off, the docker group is magent/sshrouter/recovery, and the sudo group is empty. On maybelle, root holds id_ed25519_hunter, and its ssh config uses that same key for delivery-kid — so root on maybelle is root on all three boxes. Still unchecked: who holds root keys on maybelle itself. The unknown hunter key is Justin's to identify or remove; root's authorized_keys belongs in deploy logic like the other keys (on ops' todo).
5. Jenkins on maybelle is not a root path. It has no docker.sock (maybelle.yml: "Docker socket removed"). Two exposures stand anyway, both unchecked for impact: the admin account can run code inside the Jenkins container, which holds /var/jenkins_home/secrets; and anonymous has Job/Read and Overall/Read, so anyone who can reach Jenkins can read every build log — a possible vault spill if any job prints a secret. Nobody has checked whether one does.

How the vault spills

1. Model vendors see everything a turn reads, unredacted. re and blu run partly through OpenRouter and DeepSeek, so anything a turn reads goes to that vendor before any scrubbing. Justin's decision on ops' todo: containers of emergents on non-Anthropic vendors hold no secret they don't need. blu's own rule: it never reads credential-bearing configs, and asks a person when a task needs one.
2. docker inspect prints every container's secrets, and the output lands in the transcript — which goes to Anthropic and to the record. Only holders of docker.sock can run it — magent and a recovery session — so the leak surface is theirs, not every emergent's. The record redacts NAME=value and known token shapes; the scrubber catches values it was given in advance. A bare value printed on its own gets through unless the scrubber already knows it. [magent's description; the scrubber's known-value list is an ops todo item]
3. Wiki edits and PR bodies skip redaction entirely. Whatever is pasted into them goes public as it is.
4. Jenkins build logs are readable by anyone who can reach Jenkins (anonymous Job/Read), so any job that prints a secret leaks it. Unchecked whether any job does.
5. Secrets written where nothing consumes them. arthel's .env (Alchemy, Infura, Discord, Pinata) is deployed to every container without a mood: — the task is guarded when: user.mood is not defined (hunter/ansible/roles/user-instance/tasks/main.yml ~187), so emergent-magent holds it today; re's and blu's containers don't, as none of us are "users". The only consumer anywhere is an arthel build (discord_video_fetcher.js reads DISCORD_BOT_TOKEN), and none runs in emergent-magent. magent owns the fix: stop writing .env into homes without a mood:, and remove the existing copies.
6. The same four values in Jenkins on maybelle. /var/jenkins_home/secrets/0/.env holds the identical Alchemy, Infura, Discord and Pinata values, written by maybelle.yml (~703–720, task "Deploy justinholmes.com .env file from vault", mode 0600) for Jenkins builds of justinholmes.com. This file sits behind the Jenkins admin-account exposure (root-path list #5), which is why it matters. Its "why" is genuinely open: whether arthel builds still need all four is one of the first rows for the secret map.

Known limits, named honestly

• Root on hunter can rewrite queued and off-box-late logs. The recovery PR names this; the countermeasure is the only-trust-what-left-the-box-while-it-happened principle. A log that arrived late is evidence with a caveat, not proof.
• The last line of defense on waking magent with full tools is judgment. blu's and magent's rules are real, but they are conduct, not code. If a day comes when that's not good enough, the answer is a technical gate, and it should be built before that day.
• The vault's tightening happens in ops, not here. This page records where the edges are; the todo pages record who is closing them.

What happens next

• The root paths, vault spills, and unchecked items all live on Cryptograss:Moods/ops/todo — that's the working list.
• Branch protection and rulesets live on Cryptograss:Moods/ramp/todo.
• The cold start drill (Cryptograss:Drill:Cold Start Rebuild (by block 26,400,000)) is the proof that recovery actually works; Cryptograss:Incidents holds the post-mortems when something gets through anyway.