Idunn/docs/secret-files-cut.md

Binding secrets out of every printable surface: cut map

Status: cut map, Imagination pass 1 (Opus), 2026-09-30. Nothing has landed. There is no separate target document; the invariant in section 1 is the end state. Anchors are against these HEADs:

• Idunn 46d9c2f
• gamecult-ops 62e3f05
• Heimdall e8e2832
• StreamPixels a49f7d8 (reference pattern only)

Incident: during overnight work an agent printed Heimdall's deployment-binding secrets into a transcript. The operator's words: "I'll rotate before prod, not too concerned about Anthropic having my oauth; do map the cut that'll ensure it doesn't happen again".

Heimdall hands/secret-files status (Self, 2026-09-30).

• Batch 5 (efd1137..b5d7b6b) fixed Soul pass 4's four findings:
  • F1: command-plane diagnostics are fixed text plus the error's class and code, and every provider body goes through readProviderJson.
  • F2: patron support keeps only the Bifrost status.
  • F3: the recipe test records the secrets loadConfig actually reads.
  • F4: checkSchema runs on every start.
• Soul pass 5: hold. F1-F3 held. Batch 6, in Hands, fixes:
  • S5-1. checkSchema passes a DEFERRABLE key, a UNIQUE ... INCLUDE, a same-named non-unique replacement for the partial unique index, and retyped columns. Each of these breaks the store at runtime.
  • S5-2. The privilege check demands UPDATE on audit_events, which the store only INSERTs into.
  • S5-3 (older than this batch). app.ts:1310 writes a live, 300 s redeemable completion code into the audit event auth_completion_created.
  • S5-4 to S5-7. Test gaps: canary position, the errorIdentity filters, pool close, spread-env reads.
  • A flaky live-Postgres test.
• Noted, not in scope: S5-8, forced RLS with no policy passes the check.
• Batch 6 (b5d7b6b..6c0c876): S5-1 through S5-7 fixed, and the flaky live test fixed (template DB clone, fixturePool). Result: 241 passed, 24/24 live, 40 of 41 mutants killed. The survivor, X13, is equivalent: pg-pool destroys a failed client.
• Soul pass 6: hold. Batch 7 is in Hands.
  • F1. An invalid or not-ready unique index passes the check. That breaks sign-in (42P10) and R21.1, because a consume takes 2 rows.
  • F2. A key index under a nondeterministic collation passes, and the upsert then moves one account's identity row to another account.
  • F3. The predicate normaliser is unsound: it strips parentheses and lowercases literals.
  • F4. Some databases the store could serve are refused: indexes are required by name, and column-level grants are not accepted.
  • F5. The recipe exploration's all-at-once run stops early; mutants Z4, Z5 and Z6 survive.
  • F6-F8. An inspected cause is not covered, a narrowed predicate has no fixture, and an added NOT NULL on a nullable column is not caught. CHECK constraints and triggers are out of scope, as S5-8 is.
• Batch 7 (6c0c876..ca2366c): F1-F8 fixed.
  • Keys must be indisvalid with deterministic collations.
  • Predicates are printed by Postgres, using a TEMP table in a rolled-back transaction, and compared as sets of AND conditions.
  • Index names are not required. Column privileges are checked with has_column_privilege. A nullable column must stay nullable.
  • Results: 241 passed, 39/39 live, 60/61 mutants killed.
• Soul pass 7: merge. Nothing blocks.
  • 1400 predicate pairs were checked, and no two different predicates compared equal.
  • The indisvalid argument held under interrupted concurrent DDL.
  • TEMP is never refused for the real deployment, because the service role owns the database.
• MERGED: Heimdall main fast-forwarded to ca2366c (2026-09-30).
• Follow-up branch in Hands:
  • S7-1: the recipe exploration never runs the production start shape.
  • S7-2: extra unique indexes and similar documented as out of scope.
  • S7-3: the column collation must be deterministic.
  • S7-4: one more fixture each for Y3, Y4, Y5 and Y8.
• Recorded: a least-privilege column-subset grant is refused (F4(b)). That is theoretically servable, but it is not how Heimdall is deployed.

Rulings and defaults, 2026-09-30 (Self).

• Q3 A is the operator's ruling: "I'll rotate before prod". Cuts 1-4 land with the current values; rotation overwrites the credential files later. The token-encryption and signing-key sub-question waits for rotation time.
• Q2 A, Self's default: the plaintext fallback is a named shim, deleted in Cut 5. It is not a product decision; the operator may overrule it.
• Q1 A, Self's default: no schema change now; B is recorded as a follow-up if a second target repeats Heimdall's mistake. The operator may overrule it.

Open:

• Cut 0 capture;
• whether a re-deploy of an unchanged revision reloads a rotated credential (not yet established; see Cut 3).

1. The invariant, and why a "don't print" rule is the wrong cut

Secret material exists only in files whose sole content is one secret. Those files are root-owned, mode 0400, and delivered by systemd LoadCredential. Nothing multi-purpose ever holds a secret value:

• no binding, template, recipe, unit or transient unit;
• no plan blob, log, status line or README step.

If that holds, every existing printer becomes harmless. cat of a binding, idunn validate, a journald tail, systemctl cat, idunn status and a plan decode all show paths. No agent has to remember anything.

What was missing, such that printing the secret made sense to the agent:

• The gamecult-ops Heimdall runbook ordered it. runbooks/heimdall-discord-launch.md:142-150 says to reconstruct the missing template from the installed binding with ssh ygg 'sudo cat /etc/gamecult/idunn/bindings/heimdall.toml'.
• The installed binding carried secret values under [workload.environment].
• Heimdall's recipe declares those values as plain environment. Its admit contract therefore makes the binding the only place they can live.

The agent followed a runbook against a file that should never have held a secret. The cut removes the secret from the file, not the reading.

The substrate already exists; it is not an invention of this map:

• Idunn's [workload.secret_files] (src/deployment.rs:607) lowers to --property=LoadCredential=NAME:path (src/drivers.rs:3707-3718).
• It sets NAME=/run/credentials/<unit>/NAME in the environment (src/drivers.rs:3311-3336).
• It admits only root:root 0400 single-link sources in a root-owned directory (src/drivers.rs:6966-7000).
• Idunn never opens a service credential for reading; it only stats it.
• StreamPixels and Ghostlight already use this through *_FILE names (StreamPixels apps/service/src/security/environment-secret.ts, deployment/idunn/service.toml:130-142).

Heimdall is the target that never moved.

Leak paths found in the Body

#	Path	Evidence	After the cut
P1	Runbook tells an agent to sudo cat the installed binding	gamecult-ops runbooks/heimdall-discord-launch.md:147	step deleted (Cut 4); the file holds only paths anyway
P2	Binding install README handles the DB URL in an agent shell (export DBURL=$(sudo grep … service.env), perl substitution)	gamecult-ops deployment/idunn-bindings/README.md:15-30	directory deleted (Cut 4)
P3	Transient unit carries every workload env value via --setenv. That lands in /run/systemd/transient/<unit>.service, readable through systemctl cat and systemctl show -p Environment without privilege.	Idunn src/drivers.rs:3704-3706	only non-secret values and credential paths
P4	/proc/<pid>/environ of the workload (root-readable; Idunn itself reads it and keeps only a hash, drivers.rs:3116, :3278)	Idunn src/drivers.rs:3116	paths only
P5	Every deployment plan persists the full binding text in binding_blob. It lands in control.cc, history and the nightly state backup.	Idunn src/deployment_plan.rs:562, :710; gamecult-ops runbooks/gamecult-state-backup.md:38-39	new plans hold paths; old plans keep old values forever → rotation (Q3)
P6	TOML errors quote the offending source line verbatim. CONFIRMED by probe on toml 0.8.23: an invalid escape, a wrong type, an unknown field and an unterminated string each echoed the full KEY = "value" line. They reach journald through load_bindings (control_plane.rs:3883 → eprintln at :4597, :5350) and the terminal through idunn validate (:2475). scripts/install-idunn-yggdrasil-release.sh:38 tails that journal into the operator's terminal.	Probe: toml::from_str with four malformed lines, e.to_string() contained the canary in all four	lines hold paths only
P7	idunn status --command prints last_error verbatim	Idunn src/control_plane.rs:4131-4133	nothing secret can be in an error
P8	Legacy pre-Idunn Heimdall. systemd/heimdall.service:14 reads EnvironmentFile=/srv/heimdall/env/service.env. scripts/deploy-heimdall.sh:182 leaves .service.env.backup.* copies. scripts/check-heimdall.sh:17-20 and scripts/provision-ghostlight-heimdall-session-yggdrasil.sh:16-19 source it.	gamecult-ops	retired in Cut 5
P9	Two contradictory binding directories. deployment/idunn-bindings/ says install 0640 root:idunn. idunn/yggdrasil/bindings/README.md:24-27 says Heimdall is "intentionally absent" (stale). scripts/idunn/idunn-deployment-targets.ps1:194 repeats it.	gamecult-ops	one directory (Cut 4)

Out of scope, recorded:

• Docker runner [runners.*.environment] values reach docker run -e and docker inspect.
• No current template puts a secret there, and runner secret_files already mounts files (drivers.rs:2018-2025).

2. Identity, lifecycle, authority (per persistent kind)

Kind	What names it	Life over time	Who decides
Heimdall secret value	credential file /etc/gamecult/heimdall/credentials/<name>. Its binding key is the *_FILE env name. The directory convention follows streampixels-service.toml.in [workload.secret_files].	Created once by Cut 3. Overwritten in place on rotation (Q3). Never copied elsewhere.	operator (value); ops template (path)
Heimdall binding	target heimdall	rendered from idunn/yggdrasil/bindings/heimdall.toml.in, installed by install-idunn-yggdrasil-release.sh; hand edits on the host are forbidden writers	gamecult-ops template
Recipe input class (secret vs plain)	env name in Heimdall deployment/idunn/recipe.toml	changes only by a reviewed Heimdall commit	Heimdall repo
Plan binding_blob	plan id (content hash)	immutable history; never rewritten (rewriting breaks plan_id, deployment_plan.rs:662-668)	Idunn
Legacy service.env + backups	path under /srv/heimdall/env	read-only after Cut 3; shredded in Cut 5	operator

Constraint that shapes every Idunn-side option. An admitted generation's stored plan is re-admitted under the current rules on continuity (control_plane.rs:6871, and the other parsed_inputs() sites). Any tightening of admit() that rejects an already-stored (recipe, binding) pair takes daemon survival away from that target. New admit rules must be vacuous for recipes that predate them.

3. Authority map

• Owner of secret material: the credential file. Nothing else owns a copy.
• Owner of "is this input secret": the program's own recipe. It declares secret inputs only as *_FILE names; it declares no plaintext secret name. Idunn enforces the rest with an existing rule: a binding may bind only declared names (src/deployment.rs:1614-1617).
• Owner of the binding's shape: the gamecult-ops template. The installed file is derived from it.
• Inputs:
  • Heimdall reads *_FILE paths from its environment and the bytes from those files.
  • Idunn reads binding paths and stats the files.
• Outputs: systemd credentials under /run/credentials/<unit>/.
• Derived state:
  • The binding's [workload.secret_files] holds paths only.
  • The transient unit's LoadCredential= and Environment= hold paths only.
  • The plan blob holds paths only.
• Forbidden holders of a secret value:
  • [workload.environment];
  • any *.toml.in or template;
  • recipe required_environment and optional_environment;
  • READMEs and runbooks;
  • /srv/heimdall/env/service.env after Cut 5;
  • shell variables in any committed ops script.
• Forbidden printers: none needed. A printer of any artifact above prints no secret. The only way to see a secret is sudo cat of a single-purpose credential file, and that is a deliberate act.
• Shared paths: the same readSecretInput reader serves legacy start, Idunn start and tests (Cut 1). The same admit() serves idunn validate, binding load and continuity re-admit.
• Deletion line:
  • Heimdall's plaintext secret names in the recipe (Cut 1).
  • deployment/idunn-bindings/ and the runbook sudo cat step (Cut 4).
  • The plaintext fallback shim, the legacy unit, service.env, the legacy deploy and check scripts, and the transitional copy script (Cut 5).

4. Cuts

Cut 0. Capture (read-only, Yggdrasil; no edits)

• Rule for every command: print key names, hashes or booleans, never values.
• Never read /var/lib/gamecult/**/*.cc.
• Key names of the installed binding. Pipe the binding through this extractor. It prints section headers and key = names. It refuses base64-looking continuation lines and counts them instead. It was tested against the ops template and a multiline PEM:

  sudo awk '
  /^[[:space:]]*\[[^=]*\][[:space:]]*$/ { print; next }
  /^[[:space:]]*(#|$)/ { next }
  match($0, /^[[:space:]]*[A-Za-z_][A-Za-z0-9_-]*[[:space:]]+=[[:space:]]/) {
    k = substr($0, 1, RLENGTH); sub(/[[:space:]]+=[[:space:]]$/, "", k); gsub(/^[[:space:]]+/, "", k)
    if (length(k) <= 64) { print "  " k; next } }
  { other++ } END { print "unclassified-lines " other+0 }' /etc/gamecult/idunn/bindings/heimdall.toml
  

• Key names of the legacy environment file: sudo grep -o '^[A-Za-z_][A-Za-z0-9_]*=' /srv/heimdall/env/service.env. Count its siblings with sudo ls /srv/heimdall/env | grep -c 'service.env.backup'.
• Where each value comes from. For every secret-class name present in both sources, print only whether the two values are equal: sha256 each value inside one root shell, and emit NAME equal|differ. This decides whether Cut 3 copies from service.env or from the binding.
• What runs Heimdall now: systemctl is-active heimdall.service, plus the names of the idunn-heimdall-* units. Inventory (gamecult-ops inventory.md:632-634) says the legacy unit runs Heimdall and that Idunn has never admitted a Heimdall generation. That claim is unverified.
• Credential-source preconditions: stat -c '%U:%G %a %h' on the intended credential directory, if it exists.

Cut 1. Heimdall reads secrets from credential files

• Repo/branch: Heimdall, a branch from e8e2832. No dependencies.
• Deletes first:
  • Remove these plaintext secret names from deployment/idunn/recipe.toml:134-174:
    • GC_ACCESS_DATABASE_URL, from required_environment (:173);
    • GC_ACCESS_APP_BIFROST_SHARED_SECRET;
    • GC_ACCESS_APP_GHOSTLIGHT_SHARED_SECRET;
    • GC_ACCESS_APP_SHARED_SECRET. No reader exists for it: src/config.ts:208-216 reads only per-slug names. Delete it; do not rename it.
    • GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET;
    • GC_ACCESS_PROVIDER_{DISCORD,PATREON,TWITCH,YOUTUBE}_CLIENT_SECRET;
    • GC_ACCESS_TOKEN_ENCRYPTION_KEY_BASE64.
  • Remove the inline-PEM input GC_ACCESS_SIGNING_PRIVATE_KEY_PEM (src/config.ts:281-284). It is not declared in the recipe, and GC_ACCESS_SIGNING_PRIVATE_KEY_PATH already covers the key: bind it through secret_files under its own name, as Idunn docs/migration.md:463-472 describes.
  • Client IDs, URLs, TTLs and GC_ACCESS_APP_*_RUNTIME_IDS are not secrets and stay.
• Adds:
  • The recipe gains the _FILE twin of every deleted secret name. GC_ACCESS_DATABASE_URL_FILE is required; the rest are optional.
  • One reader in src/config.ts, readSecretInput(env, name):
    • it reads env[name + "_FILE"] and strips one trailing newline;
    • when the _FILE variable is absent, it falls back to env[name];
    • it throws if both are set, so one input has one owner;
    • its errors name the variable and the path, never the file's contents.
  • The plaintext fallback is a named shim. It protects only the legacy EnvironmentFile unit (P8), and Cut 5 deletes it (Q2).
• Per-file changes:
  • src/config.ts:124-139 (readProviderConfig, the client secret);
  • :208-216 (app shared secrets);
  • :294-296 (token key);
  • :302-304 (patron secret);
  • :306-308 (database URL); route each through readSecretInput;
  • :205: storage-backend selection must key off the resolved database URL, not env.GC_ACCESS_DATABASE_URL;
  • src/custody.ts:17,23,54: error text names GC_ACCESS_TOKEN_ENCRYPTION_KEY_BASE64_FILE;
  • src/providers.ts:24,33,42,51,65,83: clientSecretEnv becomes the _FILE name, so the published witness (src/verse-witness.ts:240-243, names only) stays truthful.
• Verification:
  • tests (vitest, a new tests/config-secrets.test.ts):
    • _FILE value is read and has its newline trimmed. Mutant: read env[name] first. It must die.
    • Both set is refused. Mutant: file wins silently.
    • A missing or unreadable file errors with the variable and path, and the message contains no byte of a canary written to a sibling file. Mutant: append the contents to the message.
    • The required database-URL file is absent → startup refused.
  • StrykerJS scoped to readSecretInput and its call sites.
  • Negative grep on the recipe returns nothing. It was tested for collision: _FILE names end in _FILE" and do not match. rg -n '"GC_ACCESS_(DATABASE_URL|[A-Z_]*_SECRET|TOKEN_ENCRYPTION_KEY_BASE64|SIGNING_PRIVATE_KEY_PEM)"' deployment/idunn/recipe.toml
  • Negative grep on source: rg -n 'env\.GC_ACCESS_(DATABASE_URL|TOKEN_ENCRYPTION_KEY_BASE64|BIFROST_PATRON_SUPPORT_SECRET)\b' src returns nothing outside readSecretInput.
  • Heavy runs go on Yggdrasil via tools/stopgap/ygg-verify.sh.

Cut 2. Pin the Idunn rule the campaign rests on

• Repo/branch: Idunn, a branch from 46d9c2f. It has no dependencies and can run in parallel with Cut 1.
• Why: the guarantee "a binding cannot carry an undeclared name" is one line (src/deployment.rs:1614-1617). Its only test, extra_operator_environment_is_rejected (:2178-2186), asserts is_err(). Any other error satisfies it, which is the cousin-not-the-rule failure.
• Changes: tests only. No behaviour change.
  1. The admit error for an undeclared [workload.environment] name is this rule. Assert on the message, or better, on a typed refusal if Hands finds one is cheap.
  2. The same assertion for an undeclared [workload.secret_files] name.
  3. idunn validate exits non-zero on an undeclared name, and its output does not contain the bound value. Use a canary; this pins P6 at the admit layer, not the TOML layer.
• Verification: run cargo-mutants --in-diff scoped to deployment.rs admit, on Yggdrasil. The mutant is_subset(..) → true at :1615 must die in tests 1 and 2.
• Deletion line: none.

Cut 3. Yggdrasil: credential files and a secret-free installed binding

• Depends on: Cut 1 merged, and Cut 0 capture read.

• First: a copy of the current installed binding goes to /root/heimdall.toml.pre-secret-cut, mode 0400. Take it with install -m 0400 and never display it. It is the rollback source until rotation; after rotation it is shredded (Q3).

• Transitional copy (Q3-A): the script is gamecult-ops scripts/provision-heimdall-credentials-yggdrasil.sh, about 40 lines, modelled on provision-ghostlight-heimdall-session-yggdrasil.sh. It must:

  • run as root and refuse otherwise;
  • read values from the source Cut 0 chose, without set -x and without printing;
  • write each value through mktemp in a root:root 0700 directory;
  • chmod 0400 each file and mv it into place;
  • print only NAME written (N bytes).

  The script is deleted in Cut 5.

• Binding edit:

  • [workload.environment] keeps only non-secret declared names.
  • [workload.secret_files] gains the *_FILE entries.
  • GC_ACCESS_SIGNING_PRIVATE_KEY_PATH is bound there if it is not already.

• Verification, in this order, printing only exit codes and counts:

  1. idunn validate --recipe <new recipe> --binding <new binding> succeeds.
  2. idunn validate --recipe <new recipe> --binding /root/heimdall.toml.pre-secret-cut > /dev/null 2>&1; echo $? is non-zero. This is the negative check: the old shape is now inadmissible. Discard the output; it could quote a line.
  3. Run the Cut 0 extractor on the installed binding. Every [workload.environment] name must be in the recipe's non-_FILE declared set.
  4. After idunn up heimdall, run systemctl show -p Environment --value <idunn-heimdall unit> | tr ' ' '\n' | cut -d= -f1 to list names only. Every *_FILE value starts with /run/credentials/; print only a boolean per name.
  5. The P6 regression probe: make a scratch copy of the new binding with one line corrupted, and run idunn validate on it. Its output contains only paths.

• Not yet established: whether idunn up heimdall on an unchanged revision starts a fresh unit, and so reloads a rotated credential. Hands probes it and reports; the map's rotation step depends on the answer.

Cut 4. gamecult-ops: one binding directory, template derived from a secret-free binding

• Repo/branch: gamecult-ops main from 62e3f05. Depends on Cut 3's verification step 3 passing. From then on, copying the installed binding is safe by construction.
• Deletes first:
  • deployment/idunn-bindings/README.md (76 lines) and deployment/idunn-bindings/heimdall.toml.template (119 lines): the second authority and P2.
  • runbooks/heimdall-discord-launch.md:142-150, the reconstruct-by-sudo cat paragraph (P1).
  • idunn/yggdrasil/bindings/README.md:24-27, the stale "Heimdall is intentionally absent" paragraph.
• Adds: idunn/yggdrasil/bindings/heimdall.toml.in. It is the post-Cut-3 installed binding, with only the signer id replaced by PROVISIONED_HEIMDALL_SIGNER_ID, following the README's convention.
• Keeps and moves:
  • Carry one sentence into idunn/yggdrasil/bindings/README.md: secret inputs are [workload.secret_files] paths to root:root 0400 credential files, and a template never holds a value.
  • The README's field and preprovisioning tables duplicate Idunn docs/migration.md:440-472. Point to that instead of moving them.
  • Reconcile the install mode. The README says 0644 and scripts/install-idunn-yggdrasil-release.sh:32 installs 0640. Make the README say what the script does.
  • Update scripts/idunn/idunn-deployment-targets.ps1:194 and runbooks/heimdall-discord-launch.md §4 to name the template.
• Verification:
  • Render the template and diff it against the installed binding on Yggdrasil. The only difference is the signer-id line. This diff is safe to print only because Cut 3's step 3 passed.
  • Negative greps, each returning nothing:
    • rg -n 'sudo cat /etc/gamecult/idunn/bindings' runbooks
    • rg -n 'REPLACED_ON_INSTALL' .
    • rg -n 'deployment/idunn-bindings' . -g '!docs/repo-census-2026-09/**'
  • Run the key-name extractor over idunn/yggdrasil/bindings/*.toml.in. No [workload.environment] name ends in SECRET, _KEY, PASSWORD, TOKEN or DATABASE_URL. This is a review aid, not an enforcement: enforcement is admit plus the recipe.

Cut 5. Retire the legacy Heimdall path

• Depends on: Heimdall running as an Idunn-admitted generation, and the legacy unit stopped. If Cut 0 shows Heimdall is not yet admitted, this cut waits on that admission. It is not a fork.
• Deletes first:
  • In gamecult-ops:
    • systemd/heimdall.service (28 lines);
    • scripts/deploy-heimdall.sh (238);
    • scripts/check-heimdall.sh (58; it sources service.env);
    • scripts/test-heimdall-yggdrasil-wiring.sh (45);
    • scripts/provision-ghostlight-heimdall-session-yggdrasil.sh. It sources service.env, and after rotation the operator writes Ghostlight's copy of the shared secret directly;
    • the transitional provision-heimdall-credentials-yggdrasil.sh;
    • runbook §2 "Upload The Service Env" and the §5 check-heimdall.sh steps;
    • the scripts/README.md:33-34,46 entries.
  • In Heimdall: the plaintext fallback in readSecretInput.
  • On Yggdrasil: disable the legacy unit, then shred -u /srv/heimdall/env/service.env, every .service.env.backup.* and .service.env.candidate.*, and /root/heimdall.toml.pre-secret-cut.
• Verification:
  • rg -n 'service\.env' scripts runbooks systemd returns only history notes.
  • Heimdall test: setting a plaintext name without its _FILE twin no longer configures the secret. Mutant: restore the fallback.

5. Operator questions

Q1. Should Idunn type the secret/plain distinction in the recipe schema?

• A: No schema change. Heimdall's recipe declares secrets only as *_FILE names, and the existing rule "a binding binds only declared names" does the enforcing (Cuts 1–2).
• B: Add required_credentials and optional_credentials to ServiceDeclaration (src/deployment.rs:112-126). admit() then refuses a declared credential in [workload.environment], which closes the loophole of binding a *_FILE name to a readable non-credential path. Because of the continuity re-admit (§2), the rules must be vacuous for old recipes, and every recipe would migrate.

Recommended: A. Neither option stops a recipe author from declaring a secret as plain environment. Only the author knows what a string means, and B changes nothing about that. B's real gain is the loophole, and that loophole leaks to the filesystem, not to transcripts. Record B as a follow-up if a second target repeats Heimdall's mistake.

Q2. Should Heimdall keep the plaintext fallback during the legacy period?

• A: Keep it as a named shim. Setting both the value and its _FILE twin is refused, and the shim is deleted in Cut 5.
• B: Go file-only now. That requires Heimdall to be Idunn-admitted and the legacy unit retired in the same move.

Recommended: A. Inventory says the legacy unit is what runs Heimdall today. Under Idunn the fallback is inert, because admit refuses the plaintext names.

Q3. How should rotation be sequenced? ("I'll rotate before prod")

• A: Land Cuts 1–4 with the current values, copied by the transitional script without being displayed. Rotate later, before prod, by overwriting the credential files and redeploying.
• B: Rotate at Cut 3. The operator writes the new values straight into the credential files and no copy script exists.

Recommended: A. Rotating before the cut would pour the new values into the same leaky binding. Rotating at the cut blocks it on the operator, and it cascades: the app shared secrets must change in Ghostlight, StreamPixels and Bifrost's credential files in the same window.

Either way:

• Old values stay in every stored plan's binding_blob, in history and in backups (P5). Rotation, not history rewriting, is what makes them dead.
• Rewriting plans breaks plan_id (deployment_plan.rs:662-668).

Sub-question for rotation time, if Cut 0 shows GC_ACCESS_TOKEN_ENCRYPTION_KEY_BASE64 was in the binding: rotating that key makes the stored encrypted provider tokens undecryptable (src/custody.ts). Should Heimdall re-encrypt them, or should users re-link? The answer depends on how many linked accounts exist before prod. The signing key has the same shape: rotating it invalidates issued tokens.

6. Subtraction ledger (estimate)

Cut	Removed	Added	Notes
1	~12 recipe names, inline-PEM path (~5), per-site env reads (~15)	~12 _FILE names, reader (~20), tests (~80)	net-positive only in tests
2	0	~40 test lines	pins an existing rule
3	secret values from the installed binding	1 transitional script (~40)	script dies in Cut 5
4	195 (second binding directory), ~9 runbook lines, ~5 README lines	~120 template	template replaces the second directory
5	~420 ops lines, the shim, the legacy unit, service.env + backups	0

Follow-ups outside this migration:

• Q1-B, if a second target repeats Heimdall's mistake.
• Docker runner environment is visible through docker inspect (Idunn src/drivers.rs:2016-2017). No current binding puts a secret there.
• The P6 echo also applies to recipes. They are repo files and hold no secrets by construction, so no action is needed.