Credential and access register¶
Revalidated 2026-10-10 for frozen task v14, from the assigned repository snapshot; see evidence. This is an inventory of every credential class and named access found in the reviewed sources, not a live enumeration of issued tokens or provider accounts. No production probes, secret-file reads or credential changes were performed. Paths below are references from source, never evidence that those files were opened or exist on production.
All last-rotation dates, individual holders and live expiry dates are unknown. Holder roles below are documented custody or proposed responsibility, not verified possession. All intervals are proposals for owner approval, except explicitly identified protocol lifetimes. Security should obtain value-free owner/DevOps confirmation of custody and dates by 2026-10-17; an unknown date does not establish that a credential is overdue. After confirmation, next due = last verified rotation + approved interval. Every class also needs revocation/replacement on compromise, device loss or holder departure.
Server, database and signing material¶
| Entry / env name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
DB password: HEYAIRA_DB_PASSWORD; Compose POSTGRES_PASSWORD alias; protected .env under /srv/heyaira/config/ (older docs use /srv/heyaira/app/) |
PostgreSQL, API server, server-beat, server-beat-runner, backup; shared DB login |
DevOps under owner authority; runtime env in those containers | 90 days, coordinated across all consumers |
Credential-bearing DSN: HEYAIRA_DATABASE_URL |
Settings.from_env and Beat override component-based DB settings; not passed by base Compose |
DevOps or local operator; process environment | Same as embedded DB password; never store the DSN in evidence |
DB role: HEYAIRA_DB_USER / POSTGRES_USER, default role heyaira; HEYAIRA_DB_NAME, HEYAIRA_DB_HOST, HEYAIRA_DB_PORT identify its target |
Same services; PostgreSQL image bootstrap creates the initial administrative role; services also run migrations | DevOps; PostgreSQL catalog. Existing production grants unknown | Monthly grant review; password as above; split runtime/migration/backup roles proposed in R02 |
Cursor HMAC: HEYAIRA_DOCUMENT_CURSOR_SECRET |
Git-document cursor signing; defaults to the DB DSN in src/heyaira/config.py; base Compose does not pass an independent key |
DevOps / API process | Independent key every 90 days; coordinate invalidation of existing cursors |
Enrollment HMAC: HEYAIRA_BRIDGE_ENROLLMENT_SECRET |
Server Bridge enrollment derivation | DevOps; protected server env | 90 days with enrollment/retry coordination; separate from transport secret |
Transport HMAC: HEYAIRA_BRIDGE_TOKEN_SECRET |
Server transport-token derivation and rotation protocol | DevOps; protected server env | 90 days after compatibility/recovery plan; distinct from enrollment key |
Decision-link signing key: HEYAIRA_DECISION_LINK_KEY_FILE, local-only inline HEYAIRA_DECISION_LINK_KEY; public selector HEYAIRA_DECISION_LINK_KID |
Server decision viewing handles when HEYAIRA_DECISIONS_ENABLED; handles do not authorize owner answers |
DevOps; mode-0600 file in ./secrets, mounted under /run/heyaira-secrets |
90 days; change key and KID together, invalidating outstanding handles; no old-key grace |
| Decision confirmation passkeys / account authenticators | Owner WebAuthn answers, enrollment and revocation; server stores public verification material | Owner's authenticators/passkey store; private keys stay there | Monthly enrolled-device review; replace on loss/compromise, not arbitrary periodic private-key export |
One-time decision enrollment code; /decide/enroll; decision/key ceremony challenges |
Bootstrap/recover owner authenticator; challenges bind assertions to the operation | DevOps issues only on owner's explicit go; code delivered directly by SES e-mail to owner, never through agents | One use, configured expiry; ceremony challenge lifetime two minutes; remove unused enrollment on abandonment |
Signed viewing handles /decide/<handle> and OAuth consent/code/PKCE state |
Short-lived navigation/authorization handoffs; sensitive even when not sufficient alone | Browser/client memory; server hashes or bounded challenge state | Per flow; never reuse or log; expire via protocol |
Sources: compose.yaml, src/heyaira/config.py, docs/DEPLOYMENT.md,
docs/specs/decisions/D1b-implementation.md, docs/MCP_PUBLIC.md.
Configuration cross-check: the credential-bearing settings in Settings.from_env
are the DB password/DSN, document cursor secret, GitHub App key and webhook
secret files, OpenBao token file, APNs key file, decision key/file and both
Bridge signing secrets. Each has a row here or in the provider sections below.
Compose additionally wires SES enrollment mail and the backup/retention env
files; the repair overlay adds SES and pulse files. Identifiers, CA bundles,
TTL settings and authorization allowlists are recorded as metadata or controls,
not as passwords. SECRETS_MODE in ops/deploy-heyaira.sh is a directory-mode
check, not another secret. Synthetic claim examples and disposable CI passwords
are represented by their credential classes, without copying their values.
HeyAira clients, tokens and memberships¶
| Entry / name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
Static project bearer / consent credential; secrets/heyaira.token, /run/heyaira-secrets/heyaira.token; local example secrets/local.token; CLI --token-file |
Internal MCP clients, OAuth consent, owner/admin CLI workflows; exact role limits in review | Owner; explicitly authorized operator/client protected config; server project_tokens stores hashes |
90 days; separate principal per consumer; revoke unused tokens and their grant families |
| OAuth public clients: ChatGPT, Claude/claude.ai, Codex and Cursor / other MCP clients using dynamic registration | Project-resource-bound authorization code + PKCE, explicit consent; public clients have no client secret | Owner authorizes each connector; client registration metadata in oauth_clients |
Monthly redirect/grant review; remove unused registrations; re-consent at least every 90 days proposed |
OAuth confidential client client_secret / client_secret_hash (client_secret_post or client_secret_basic) |
Registered confidential MCP client authentication at token exchange | Client's protected store; server hash only; registration JSON excludes plaintext | 90 days proposed, re-register/reconnect if needed; current server requests non-expiring client secrets |
OAuth access and refresh tokens (oauth_access_tokens, oauth_refresh_tokens) |
MCP and Bridge-facing project APIs; grant scopes intersect current membership | Client secure store; server token hashes / family revocation state | Actual access 15 minutes; refresh 30 days and rotates on each use; monthly family review and 90-day re-consent proposed |
iOS public OAuth client, task reference a7c2be96 (public client identifier, not a secret fragment); HeyAiraOAuthClientID in ios/HeyAiraBridge/HeyAiraBridge/Info.plist |
Callback eu.heyaira.bridge://oauth/callback; scopes memory:read tasks:read documents:read notifications:write offline_access; shared /mcp resource |
Owner / iOS app; oauth-tokens and device-id in iOS Keychain. No client secret |
Same token lifetimes above; monthly phone/grant review; registration ID is not rotated like a secret |
| Temporary Bridge project-binding OAuth client/grant | heyaira-bridge project bind; tasks:read bridge:bindings:write, exact project's resource; transport co-signature when needed |
Owner / Bridge Mac browser; token held temporarily and revoked after attempt | Per binding attempt; verify cleanup, never retain for background work |
Project roles owner, admin, contributor, viewer; account catalog editor grants and organization permissions |
Current memberships narrow static and OAuth authority; catalog writes also need explicit editor authority | Owner delegates; PostgreSQL membership/grant records | Monthly and on role/departure change; not passwords or PostgreSQL roles |
| Per-execution MCP token and lease/claim credentials | Assigned task version and memory reads; worker execution:result; verifier read-only. No dispatch/status/criteria authority |
Bridge and sandboxed worker/verifier execution; server hash and lease state | Per attempt/lease; revoke on completion/cancellation; never reuse across tasks |
Interactive claim secret, task_claims.secret_hash; claim report/renew/release routes |
Proves possession of an interactive claim in addition to enrolled-node/project authorization; not an OAuth scope or workflow token | Bridge Mac claim state; server hash only | Per claim; stop use on release/takeover/expiry; monthly abandoned-claim review |
Script input credentials: --token-file in smoke/continuity/multi-client scripts, config["token"] in scripts/cold_handoff_client.py |
Selected project only; scripts can mutate synthetic state | Authorized operator, protected input file; not the non-secret identity profile | Issue for test window, revoke immediately afterwards |
Canary-created OAuth client/grant, 20-minute access token in scripts/production_catalog_background_canary.py |
Synthetic project canary; scopes memory:read tasks:read tasks:write agents:read agents:write documents:read; SSH seeds DB |
Authorized DevOps process memory over SSH; current node transport supplied locally | One run; cleanup synthetic project/client in finalization; never use as standing access |
Sources: src/heyaira/oauth.py, docs/MCP_PUBLIC.md,
docs/reference/mcp-endpoint.md, docs/getting-started/clients.md,
docs/reports/2026-10-03-oauth-client-secrets-candidate.md,
docs/BRIDGE_IOS_COMPANION.md, ios/HeyAiraBridge/HeyAiraBridge/OAuthClient.swift,
docs/concepts/bridge-project-scope.md, docs/concepts/task-version-execution.md,
docs/reference/catalog-provisioning.md, docs/specs/org-v1/S0-spec.md,
src/heyaira/claims.py, scripts/.
Bridge, Mac and provider accounts¶
| Entry / name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
| Ed25519 Bridge private identity key; public key/fingerprint registered server-side | Enrollment nonce proof and device identity | Bridge Mac Keychain; server stores public metadata only | Monthly device/custody review; annual planned re-enrollment or immediately on loss, with owner-approved recovery |
One-time enrollment bootstrap credential; operator --token-file / protected mode-0600 output |
create-bridge-enrollment-credential, one project and approved account references |
DevOps transfers through approved channel to Bridge Mac; server hash only | One use; revoke if unused; enrollment challenges expire after five minutes |
bridge:transport active/pending successor tokens and durable rotation journal |
Offers, bound-project feeds, execution lifecycle, publication reports, binding co-signature | Bridge Mac Keychain / protected rotation state; server hashes | Actual HEYAIRA_BRIDGE_TOKEN_TTL_SECONDS default 900; prepare/confirm HEYAIRA_BRIDGE_ROTATION_TTL_SECONDS default 300; rotate before expiry |
Recovery credential /run/heyaira-secrets/bridge-recovery.json |
recover-bridge-token after active token expiry; exact existing project/Bridge |
DevOps protected file, securely piped to Bridge recovery; then Keychain | One recovery, remove transfer file after success; not routine rotation |
Legacy pairing code /run/heyaira-secrets/bridge-pairing-code |
heyaira-admin create-bridge-pairing, POST /bridge/v1/pair |
DevOps / Bridge Mac; one-time transfer file | Per pairing; remove after use |
Legacy paired-node access and refresh credentials in bridge_credentials |
Heartbeats and single-project node feeds; paired node still required alongside enrollment | Bridge Mac secure store; server hashes | Actual access 15 minutes; refresh 30 days and does not rotate at /bridge/v1/token; review/re-pair before expiry |
| OpenAI/Codex and Anthropic/Claude provider OAuth refresh tokens, API keys, CLI sign-in state | Local provider execution under selected account slot | Owner's Bridge Mac/provider stores; never server or OpenBao. No concrete provider env variable specified by these contracts | Provider-managed refresh; API keys 90 days proposed; monthly account-slot review and revoke on loss |
| Bridge GitHub publication login (Git credential / SSH key / CLI authorization; exact mechanism unknown in this repo) | Bridge pushes accepted commits and opens PRs in permitted repositories | Owner / Bridge Mac; not worker or server credential | 90 days for reusable token/key proposed; monthly repository/permission review |
Bridge policy allowed_accounts, allowed_models, repository/workspace mappings, allowed_runtimes, permission policy and node-project bindings |
Limits which local provider/repository resources a sent task may use | Owner-approved Bridge Mac policy; server approved account references/bindings | Monthly and each change; these are non-secret authorization records, not new credentials |
Sources: docs/BRIDGE_PROTOCOL.md, docs/concepts/bridge-enrollment.md,
docs/concepts/bridge-identity.md, docs/concepts/bridge-project-scope.md,
docs/concepts/credential-broker.md, docs/ARCHITECTURE.md,
scripts/production_catalog_background_canary.py (synthetic policy example,
not proof of the installed Mac policy). Bridge implementation lives in its
own repository and was not inspected in this task.
GitHub and CI¶
| Entry / env name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
GitHub App private key: HEYAIRA_GITHUB_APP_PRIVATE_KEY_FILE, secrets/github-app.pem; HEYAIRA_GITHUB_APP_ID and installation ID are public selectors |
API mints installation tokens; approved Git documents, PR-head checks and CI results | Owner installs App; DevOps holds mode-0600 key for API | 90 days; validate successor before removing old App key |
| GitHub App installation tokens | Cached, short-lived server GitHub API access selected by repository binding | API memory / GitHub; never reused as MCP credential | Renew before provider expiry (normally one hour); monthly installation/repository permission review |
Webhook HMAC: HEYAIRA_GITHUB_WEBHOOK_SECRET_FILE, secrets/github-webhook.secret |
/github/webhooks signature validation |
Owner/GitHub App settings and DevOps/API mounted file | 90 days, coordinate both ends |
GitHub Actions job token GITHUB_TOKEN / implicit github.token used by actions/checkout |
CI and documentation checkout; workflows set contents: read |
GitHub issues per job; runner receives it; checkout may persist it during job | Per job; remove persisted checkout credentials when unnecessary |
Self-hosted runner registration and persisted runner credentials; heyaira-ci-a, heyaira-ci-b (assignment names), label heyaira-ci, OS user heyaira-ci, host runner |
Executes pull-request code and rootless Docker test services; two runners share one daemon | Owner/GitHub admin and DevOps/CI runner; credential paths not in repository | Registration token per enrollment; monthly review; re-register long-lived runners at least every 90 days or after suspicious jobs |
CI/local PostgreSQL maintenance role postgres; HEYAIRA_TEST_ADMIN_DATABASE_URL, workflow POSTGRES_PASSWORD |
scripts/test_postgres.py creates/drops disposable databases; workflow password is explicitly synthetic, not reproduced here |
CI runner/local test operator, loopback-only ephemeral DB | New isolated DB per job; destroy at job end; no production reuse |
Test DSN aliases: HEYAIRA_AGENT_E2E_DATABASE_URL, HEYAIRA_BACKUP_E2E_DATABASE_URL, HEYAIRA_BIND_E2E_DATABASE_URL_A, HEYAIRA_BIND_E2E_DATABASE_URL_B, HEYAIRA_BIND_SCRIPTS_DATABASE_URL, HEYAIRA_BRIDGE_E2E_DATABASE_URL, HEYAIRA_EXECUTION_E2E_DATABASE_URL, HEYAIRA_F1_E2E_DATABASE_URL, HEYAIRA_F2_E2E_DATABASE_URL, HEYAIRA_INBOX_E2E_DATABASE_URL, HEYAIRA_PROJECT_RESOURCE_E2E_DATABASE_URL, HEYAIRA_PROJECT_SCOPE_E2E_DATABASE_URL, HEYAIRA_SERVER_BEAT_E2E_DATABASE_URL, HEYAIRA_SUMMARY_E2E_DATABASE_URL, HEYAIRA_WORKCENTER_APP_E2E_DATABASE_URL |
Test runner fan-out to disposable database tests; DSNs can embed passwords | CI runner/local test process, no production credential | Per test run; never point at production |
Sources: compose.yaml, src/heyaira/config.py, docs/DEPLOYMENT.md,
docs/GIT_DOCUMENT_ACCESS.md, .github/workflows/ci.yml,
.github/workflows/docs.yml, scripts/test_postgres.py, docs/operations/testing.md.
No named GitHub Actions repository secret or deployment credential is referenced
by either workflow. Runner instance names come from the task; the workflow
itself names only their common label, user and host.
Vault and mobile delivery¶
| Entry / env name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
OpenBao application token: HEYAIRA_OPENBAO_TOKEN_FILE, secrets/openbao.token |
API KV v2 mobile-token vault; policy permits create/read/update/delete device data and read/list metadata | DevOps protected mode-0600 file; API; not Beat/runner (empty token file setting there) | Prefer renewable short-lived lease, at most 24 hours proposed; until automated renewal exists, owner-approved 30-day replacement plan |
| OpenBao initial root token / administrative login and unseal shares | Initialize, unseal, policy administration and disaster recovery; the runbook illustrates one share with a threshold of one, not proof of deployed custody | Owner offline custody; no application/root-token reuse; exact production share holders unknown | Revoke bootstrap root token after setup; monthly recovery-custody review; rekey shares on compromise/holder change; owner decides recovery quorum in R06 |
APNs device tokens at secret/data/heyaira/bridge/mobile/devices/<device-id>/apns-token |
iOS registration and API push delivery; DB stores token hash/metadata only | iOS memory transiently; encrypted OpenBao KV storage | Apple-driven changes; update on registration, revoke on sign-out/loss; monthly stale-device review |
APNs provider private key: HEYAIRA_APNS_KEY_FILE (.p8); selectors HEYAIRA_APNS_KEY_ID, HEYAIRA_APNS_TEAM_ID, HEYAIRA_APNS_TOPIC |
API APNs signing/delivery, gated by HEYAIRA_APNS_ENABLED and HEYAIRA_APNS_ALLOW_PRODUCTION |
Owner Apple developer account; DevOps mounted private key | 180 days proposed with Apple key-limit-aware overlap; monthly access review |
OpenBao CA bundle HEYAIRA_OPENBAO_CA_BUNDLE, secrets/openbao-ca.pem; endpoint HEYAIRA_OPENBAO_ADDR, BAO_ADDR; namespace HEYAIRA_OPENBAO_KV_MOUNT, HEYAIRA_OPENBAO_KV_PREFIX |
Public trust and routing material, not secrets. Production overlay currently uses private-network HTTP | DevOps; CA issuing private key would need separate custody if TLS is provisioned | Review trust/expiry monthly; renew before certificate expiry; do not rotate public identifiers as passwords |
| Apple code-signing/distribution identity, provisioning profile and developer account session | iOS device/TestFlight/App Store delivery; distinct from APNs provider key | Owner / authorized Apple release operator; location not specified in repository | Certificate expiry and device/team changes; monthly team review; no release authorization in this task |
Sources: docs/BRIDGE_OPENBAO.md, ops/openbao-mobile-policy.hcl,
ops/openbao.hcl, ops/openbao-production-compose.yaml,
docs/BRIDGE_IOS_COMPANION.md, ios/HeyAiraBridge/README.md.
Backups, monitoring and external providers¶
| Entry / env name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
R2 writer: HEYAIRA_BACKUP_R2_ACCESS_KEY_ID, HEYAIRA_BACKUP_R2_SECRET_ACCESS_KEY in backup.env |
Backup upload/list/read and restore helper; retention fallback; object read/write also permits deletion | DevOps/backup container; owner Cloudflare account | 90 days; one backup bucket only; R03 proposes protection against deletion |
R2 retention: HEYAIRA_RETENTION_R2_ACCESS_KEY_ID, HEYAIRA_RETENTION_R2_SECRET_ACCESS_KEY in retention.env |
Retention list/read/promote/delete and status reports; only retention service | DevOps/retention container, separate from writer | 90 days, separately revocable; remove fallback to writer as a follow-up |
| Optional R2 restore-only credential (no env name specified) | Isolated restore executor, read-only objects | Owner/restore Mac; optional recommendation, not proven provisioned | 90 days; bucket read-only scope |
Rclone aliases RCLONE_CONFIG_R2_ACCESS_KEY_ID, RCLONE_CONFIG_R2_SECRET_ACCESS_KEY; HEYAIRA_BACKUP_R2_ENDPOINT, HEYAIRA_BACKUP_R2_BUCKET, HEYAIRA_RETENTION_R2_ENDPOINT, RCLONE_CONFIG_R2_ENDPOINT are public routing selectors |
Child processes get their role's R2 credential, including server-helper.sh |
Backup/retention/restore processes, same credential as rows above | Inherit parent rotation; never duplicate independent secrets unnecessarily |
Public age recipient HEYAIRA_BACKUP_AGE_RECIPIENT; private identity HEYAIRA_BACKUP_AGE_IDENTITY, documented Mac working copy ~/.config/heyaira/backup-age-identity.txt, ignored secrets/age/ reference |
Backup encrypts with public recipient; isolated restore decrypts with private key | Owner Apple Passwords/iCloud emergency custody; mode-0600 working copy on restore Mac; never production server | Annual key/custody review; new recipient annually proposed; retain old private key until last dependent backup expires |
Generated pg_service.conf under backup work directory (HEYAIRA_BACKUP_WORK_DIR), libpq PGSERVICEFILE / PGSERVICE |
Backup child pg_dump authenticates with a mode-0600 copy of the DB password |
Backup runtime temporary directory, not Git | Same password rotation as DB row; recreate runtime file and clean work state after job/runtime lifecycle |
SES SMTP username, password in secrets/ses.json; HEYAIRA_SERVER_BEAT_SES_CONFIG_FILE; server alias HEYAIRA_DECISION_ENROLLMENT_SES_CONFIG_FILE |
Beat runner and host watchdog alerts; server admin CLI decision enrollment e-mail | DevOps; protected file mounted read-only for runner; owner AWS account | 90 days; dedicated sender identity and minimal SES send rights; coordinate all consumers |
Watchdog ingest bearer secrets/pulse.token, HEYAIRA_SERVER_BEAT_PULSE_TOKEN_FILE, Worker PULSE_INGEST_SECRET |
Runner authenticates periodic /pulse to external watchdog |
DevOps/runner file and owner-authorized Cloudflare Worker secret binding | 90 days synchronized on both ends; remove retired Worker bindings |
External watchdog SES API pair SES_ACCESS_KEY, SES_SECRET_KEY; SES_REGION, ALERT_FROM, ALERT_TO are routing metadata |
Cloudflare Worker sends independent AWS SigV4 SES alerts; not SMTP password | Owner AWS/Cloudflare administration; Worker secret bindings | 90 days; dedicated send-only key and approved sender/recipient |
OVH watchdog OVH_APPLICATION_KEY, OVH_APPLICATION_SECRET, OVH_CONSUMER_KEY; OVH_REBOOT_URL selects target |
Worker can reboot specified VPS only when OVH_REBOOT_ENABLED and budgets allow |
Owner/DevOps in Worker secret bindings; OVH provider grant | 90 days; exact reboot route/VPS grant, no general account-management rights |
| Cloudflare dashboard session / Wrangler login or API credential (mechanism not specified); Pages Git integration authorization | DNS, TLS, Worker deployment/secrets, R2 token administration, marketing Pages and Git-connected docs publication | Owner / explicitly authorized DevOps; local protected provider store, never these workflows | Monthly service/account grants; API keys 90 days; prefer separate scoped credentials per job |
| OVH owner/admin account and administrative sessions | VPS console/recovery, account management; separate from bounded watchdog key | Owner; DevOps only by delegation; exact store unknown | Monthly admin/MFA review; session/provider lifecycle; remove stale delegates |
| Google GTM, GA4 and Search Console account sessions/permissions | Analytics/tag publication and verified site administration; IDs/verification metadata in docs are public selectors | Owner / authorized marketing operator; browser/provider store, not application runtime | Monthly editors/owners review; revoke unused sessions/integrations; no API secret evidenced in analytics export |
Sources: docs/BACKUP_RUNBOOK.md, src/heyaira/backup_runtime.py,
ops/restore-rehearsal/, compose.yaml, docs/SERVER_BEAT_RUNBOOK.md,
ops/server-beat-repair-compose.yaml, ops/cloudflare/server-beat-watchdog/,
docs/WWW_SETUP.md, docs/operations/documentation-workflow.md,
docs/analytics/README.md, docs/analytics/SEARCH_CONSOLE.md.
Host and local administrative access¶
| Entry / env name or path | Consumer and authority | Holder / storage boundary | Proposed rotation / review |
|---|---|---|---|
Dedicated HeyAira SSH key/user; scripts/production_catalog_background_canary.py --ssh-key --ssh-host; HEYAIRA_RESTORE_SSH_TARGET (default alias heyaira-server) |
DevOps shell, deploy and docker exec; restore rehearsal uses passwordless sudo -u heyaira sh -s |
Owner/DevOps or restore Mac private key; remote authorized_keys; precise login user/key path not committed |
Annual key replacement proposed; monthly authorized-key/sudo review, immediately remove unused access |
| Tailscale device/node keys and administrative enrollment authorization (no exact file/env specified) | Private network route documented for Bridge; network reachability does not replace Bridge API authentication | Owner/tailnet administrator and Mac/server Tailscale secure state; implementation/custody not enumerated here | Provider-managed key expiry; monthly node/ACL/admin review; remove retired devices immediately |
Runtime OS user heyaira, rootless Docker socket (HEYAIRA_REPAIR_DOCKER_SOCKET), container exec |
Full application-container and DB authority inside dedicated runtime, despite rootless host boundary | DevOps/runtime user; host Unix permissions | Monthly group/socket/mount review; no credential value to rotate |
Separate root-admin channel, sudo for Caddy/recovery |
Host edge and service administration beyond runtime user | Owner or explicitly delegated host administrator; actual mechanism unknown | Monthly sudo/admin/MFA review; SSH key cycle above |
Repair broker Unix socket HEYAIRA_REPAIR_BROKER_SOCKET; directory HEYAIRA_REPAIR_BROKER_DIRECTORY; host ~/.config/heyaira/repair-broker.env and watchdog.env |
Runner/watchdog invoke bounded restarts; broker alone owns Docker socket; allowlist in HEYAIRA_SERVER_BEAT_ALLOWED_CONTAINERS and HEYAIRA_REPAIR_COMPOSE_PROJECT |
DevOps/user units; mode-0700 host directory; socket file permissions, not bearer auth | Monthly socket ACL/allowlist review; no password |
| Caddy TLS/ACME private keys and account material (storage path not specified), Cloudflare edge certificates | TLS server authentication for public MCP endpoint | Host edge administrator / Cloudflare; no values in repo | Automatic certificate renewal before expiry; monthly trust/renewal review; incident replacement |
Sources: docs/DEPLOYMENT.md, docs/reports/2026-09-22-rollout-preflight.md,
ops/caddy-heyaira.sh, ops/deploy-heyaira.sh, ops/systemd/,
ops/restore-rehearsal/mac-restore-rehearsal.sh, docs/SERVER_BEAT_RUNBOOK.md,
docs/BRIDGE_PROTOCOL.md.
The source does not enumerate real SSH logins, sudoers, DB grants or provider
memberships. These need the next owner-authorized review; none was guessed.