🤖 SSH access ledger — the why-entries

One JSON file per entry — changelog-style, so parallel PRs never conflict. These are the human half of the public SSH access ledger (status.elevenmessenger.com/ssh.html): the box-side collector (deploy/ssh-ledger-collect.sh) publishes the automatic truth (who connected, when, from where) from sshd's journal; the files here say why. The collector merges them into ssh-entries.json and the page joins entry to session by operator + date/time-window overlap. Full picture: docs/status.md § The SSH access ledger.

The convention

Any session — Claude or human — that SSHes to the router box adds an entry file here, in the same PR as the work (or an adjacent one). A session the collector can't match to an entry renders loudly on the public page as "no summary recorded" — that state is the enforcement, so don't let it be yours. One entry may cover several sessions in the same working window.

File name: YYYY-MM-DD-<slug>.json (like a changelog entry's name), e.g. 2026-07-14-wireguard-rollout.json.

{
  "date": "YYYY-MM-DD",
  "operator": "Full Name (as in web/status/ssh-operators.json)",
  "window": "HH:MM–HH:MM UTC (approx)",
  "why": "terse what-not-how summary",
  "refs": ["https://github.com/elevenmessenger/messenger/pull/NNN"]
}

• date + window are UTC and approximate — the page matches forgivingly (same operator, same date, nearest/overlapping window), so don't sweat minutes; do keep the date right.
• operator must match a handle in web/status/ssh-operators.json, or the join will miss.
• refs — PR/issue URLs or numbers the session's work landed in; may be empty.

The redaction bar (mirrors the prompt registry's)

These entries are public forever. PR review is the redaction gate — reviewers hold this line:

• What, not how. "Rotated the push relay's tokens" — never the procedure, the file paths where key material lives, or anything that maps the defences.
• Never a credential, never an email, never a secret's value or location.
• Security-sensitive sessions don't vanish — they tombstone. A session whose honest summary would itself weaken the box publishes as "why": "(withheld: security)" — the access stays on the public record, only the reason is withheld. Silence (no entry at all) is not an option: that renders as "no summary recorded", which reads as unexplained access, not protected access.