rdmsm4x — 2026-08-24 15:00 EDT — agent settings bypass normalization + XEntropy credential field evidence

Session 14:04 → 15:00 EDT, host rdmsm4x, agent claude@rdmsm4x. Mirror of the Apple Notes entry of the same name (folder: llmlog).

Ask

Check agy and all agent settings fleet-wide for settings causing issues; confirm whether "head" (vs default "fresh") on loading GitHub is correct, and configure other agents accordingly.

Key correction

The head/fresh setting is Claude Code's, not agy's: ~/.claude/settings.json → worktree.baseRef. Confirmed from the shipped binary (claude-code@latest 2.1.241): {id:"worktreeBaseRef", value: settings?.worktree?.baseRef ?? "fresh", options:["fresh","head"]} Default fresh; values fresh|head; head sets fromHead=true so a worktree/cloud bundle seeds from current local HEAD. agy has no equivalent setting. agy config lives at ~/.gemini/antigravity-cli/settings.json.

Changes (reversible, backed up)

1. worktree.baseRef → head. Set on 5/6; rdmbair13m5 was unset (silently fresh). Fixed. Backup ~/.claude/settings.json.bak-baseref-20260824-141202. Verified all six now head.
2. agy → bypass-equivalent per Rich's explicit instruction (no mid-task prompting until fleet work is consolidated on rdmsm4x). Edited in place per host; host-specific allow entries preserved (rdmsm4x 74→78, rdmpw3275m 31→35, rdmbair15m5 19→19, rdmbair13m5 8→12, rdmpw3265m 7→11, jdmbair13m5 0→4). Backups ~/.gemini/antigravity-cli/settings.json.bak-bypass-20260824-145449. This widens agy on 5 hosts — I recommended tightening, Rich overrode; his call, recorded.
3. Not changed: permissions.defaultMode already bypassPermissions on all six (standing rule: never written by an agent). Codex already danger-full-access/never on all six.

Verified final state, all six: agy=BYPASS claude=bypassPermissions/worktree=head codex=danger-full-access/never.

Audit findings (no action)

• Exact version parity fleet-wide: agy 1.1.19, claude-code@latest 2.1.241, codex present, exec bits OK.
• Neither agy nor codex runs from any launchd job — both interactive-only; neither is the automated actor in the jdmbair13m5 01:02–01:07 deletion event.
• fleet-config-sync.zsh is collect-and-push only; never writes settings back to hosts.
• FLEET HALT of 2026-08-24 00:46 still unreleased (Rich's call). No structural change made.

Credential exposure — reported only, deferred by Rich to a review in ~1 week

Cloudflare Global API key in cleartext in rdmsm4x:~/.gemini/antigravity-cli/settings.json allow entries, ~30 agy log/transcript/brain files, and 18 pushed commits in the private repo github.com/richhdoty/fleet-configs (re-pushed 14:10 EDT same day). The sync scrubber does not match Cloudflare key format. No value copied, moved, or transmitted. Rotation is Rich's.

New deliverable

rdmsm4x:~/dev/apps/Xentropy/docs/research/field-evidence-credential-sprawl-2026-08-24.md (195 lines). Read-only credential-surface census as product input for xentropy.app. No secret values — counts, paths, key names only.

Census (corrected run 15:02 EDT, one output file per host):

* scan capped at 400 files per surface; true figure higher, unmeasured.

• Every confirmed credential exposure is in AI agent state. Shell history, launchd plists, and unignored .env files measured zero on all six.
• Four divergent copies of ~/.secrets/global.env, no two identical, no superset: rdmsm4x 9 keys (Cloudflare/Atlassian/GoDaddy/ToshLLM); rdmbair15m5 a different 9 (Cloudflare/5 Wi-Fi PSKs/Tailscale); rdmpw3275m & rdmpw3265m 2 each (Cloudflare); rdmbair13m5 & jdmbair13m5 absent.
• The one credential present in all four replicas is the only unscoped one.
• The precision finding (most actionable): the fleet config repo returned 121 matching files. Hand-classified: 120 are vendor skill documentation (Cloudflare/Turnstile/agents-sdk API examples with placeholder values); exactly 1 is the real leak (rdmsm4x/agy/settings.json). 0.8% precision. A naive scanner reports 121 findings; one matters, and pattern alone cannot separate them.

Seven patterns → FR additions: P1 agent config as a source class (FR-1); P2 exposure_permanence, revocable vs immutable (FR-6); P3 report the user's own scrubber coverage gaps; P4 replica reconciliation (FR-4/5); P5 privilege_scope × replica count; P6 non-web credential types (Wi-Fi PSK, tailnet key, SSH deploy key) as an Apple-first differentiator; P7 provenance-aware container-role classification as a first-class scoring input, not a post-filter — the clearest wedge against git-secrets/trufflehog/GitHub secret scanning in a consumer product, since those assume a human triages a queue as their job.

Central insight: absence of a reachable authority manufactures sprawl — two of six hosts have no store, so a key gets pasted into a command and persisted into an allowlist forever. Absence detection is therefore predictive, not just diagnostic. First prototype recommended: replica-diff + absence-detection — path enumeration and key-name comparison only, no secret access, fits the existing read-only Phase 0 boundary.

Correction (15:10 EDT)

The first census fanned out to six hosts in parallel and its stdout interleaved, so the per-host figures in the first version of this record were misattributed. Re-run writing one file per host. Three numbers changed materially — codex on rdmsm4x 0→106 (the earlier run timed out), agy on rdmbair15m5 17→≥400, project .env on rdmsm4x 0→2 (both gitignored) — and one claim was wrong: the fleet config repo was reported as 0 and is actually 242, which is what surfaced the 0.8% precision finding. Recorded rather than quietly fixed: a number without provenance is not evidence.

Undo

• worktree: restore ~/.claude/settings.json.bak-baseref-20260824-141202 on rdmbair13m5.
• agy: restore ~/.gemini/antigravity-cli/settings.json.bak-bypass-20260824-145449 on any host.

Outstanding owner actions (Rich)

• Cloudflare Global API key rotation + fleet-configs history decision — deferred ~1 week by his instruction.
• Reconcile the four global.env replicas to one authority with a defined distribution path.
• Release or extend the FLEET HALT of 2026-08-24 00:46.