| 1 | # 🤖 SSH access ledger — the why-entries |
| 2 | |
| 3 | One JSON file per entry — changelog-style, so parallel PRs never conflict. |
| 4 | These are the *human* half of the public SSH access ledger |
| 5 | (status.elevenmessenger.com/ssh.html): the box-side collector |
| 6 | (`deploy/ssh-ledger-collect.sh`) publishes the automatic truth (who connected, |
| 7 | when, from where) from sshd's journal; the files here say **why**. The |
| 8 | collector merges them into `ssh-entries.json` and the page joins entry to |
| 9 | session by operator + date/time-window overlap. Full picture: |
| 10 | `docs/status.md § The SSH access ledger`. |
| 11 | |
| 12 | ## The convention |
| 13 | |
| 14 | **Any session — Claude or human — that SSHes to the router box adds an entry |
| 15 | file here, in the same PR as the work (or an adjacent one).** A session the |
| 16 | collector can't match to an entry renders loudly on the public page as |
| 17 | "no summary recorded" — that state is the enforcement, so don't let it be |
| 18 | yours. One entry may cover several sessions in the same working window. |
| 19 | |
| 20 | File name: `YYYY-MM-DD-<slug>.json` (like a changelog entry's name), e.g. |
| 21 | `2026-07-14-wireguard-rollout.json`. |
| 22 | |
| 23 | ```json |
| 24 | { |
| 25 | "date": "YYYY-MM-DD", |
| 26 | "operator": "Full Name (as in web/status/ssh-operators.json)", |
| 27 | "window": "HH:MM–HH:MM UTC (approx)", |
| 28 | "why": "terse what-not-how summary", |
| 29 | "refs": ["https://github.com/elevenmessenger/messenger/pull/NNN"] |
| 30 | } |
| 31 | ``` |
| 32 | |
| 33 | - `date` + `window` are UTC and approximate — the page matches forgivingly |
| 34 | (same operator, same date, nearest/overlapping window), so don't sweat |
| 35 | minutes; do keep the date right. |
| 36 | - `operator` must match a handle in `web/status/ssh-operators.json`, or the |
| 37 | join will miss. |
| 38 | - `refs` — PR/issue URLs or numbers the session's work landed in; may be empty. |
| 39 | |
| 40 | ## The redaction bar (mirrors the prompt registry's) |
| 41 | |
| 42 | These entries are public forever. PR review is the redaction gate — reviewers |
| 43 | hold this line: |
| 44 | |
| 45 | - **What, not how.** "Rotated the push relay's tokens" — never the procedure, |
| 46 | the file paths where key material lives, or anything that maps the defences. |
| 47 | - **Never a credential, never an email**, never a secret's value or location. |
| 48 | - **Security-sensitive sessions don't vanish — they tombstone.** A session |
| 49 | whose honest summary would itself weaken the box publishes as |
| 50 | `"why": "(withheld: security)"` — the access stays on the public record, |
| 51 | only the reason is withheld. Silence (no entry at all) is not an option: |
| 52 | that renders as "no summary recorded", which reads as *unexplained* access, |
| 53 | not *protected* access. |
| 54 | |
amadan