"why": "Kepler root-SSH lockdown, end to end. Expedited kepler's control binary to stable 8b793d83 (update run --ignore-bake, the sanctioned local bake bypass) to pick up the new bootstrap --ssh-noroot verb (#1300). The verb's operator gate then surfaced that kepler had never had operator setup: Paul's SSH alias was logging in as root. The retiring root session created the paul operator account, installed the committed sudoers allowlist and the lchat-svc/lchat-env-install helpers, and ran the lockdown as the operator. First run exposed a silent-success bug — kepler's pre-existing 00-hardening.conf beat the 10- drop-in on sshd's first-match — fixed on-box by renaming it to 20-hardening.conf (keeping its PasswordAuthentication no) and in code by #1312 (the verb now verifies the effective config). Verified from outside: root login refused, operator login intact. Owed: a kepler operator account for James (via his Fasthosts console; useradd is deliberately not allowlisted).",
amadan