ORGREF-WP-0002-T03 done: exposed-history review

One real exposure (Nextcloud backup token in railiance-backup, two repos),
routed to owners for rotation; no values recorded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

inventory/history-exposure-2026-10-08.md

@@ -0,0 +1,51 @@
+# Exposed history review — ORGREF-WP-0002-T03
+
+Run 2026-10-08. gitleaks v8.21.2, `--redact`, all local refs (`--log-opts=--all`)
+of every local clone whose origin is the forge: **160 repositories, no scan
+errors**. Raw reports stayed in the session scratchpad. This record contains no
+secret value, no commit author identity and no matched text.
+
+## Result
+
+283 findings in 25 repositories. After triage: **one real exposure**; everything
+else is benign.
+
+### Real: hardcoded Nextcloud backup token (rotate)
+
+| Repository | File | Since | In current HEAD |
+| --- | --- | --- | --- |
+| railiance-bootstrap | `tools/cmd/railiance-backup` line 11 | commit `4381a07`, 2026-02-25 | yes |
+| railiance-cluster | `tools/cmd/railiance-backup` line 11 | same value; file last changed 2026-07-07 | yes |
+
+`NC_TOKEN`, next to a Nextcloud URL, is the upload target for the backup tool. It
+has been readable anonymously since February. Required, regardless of closing:
+revoke and reissue it in Nextcloud, keep the new one in OpenBao only (this is
+the same custody the CCR-2026-0004 offsite backup lane asks for: `NC_WEBDAV`
+credentials in OpenBao), and remove the literal from both scripts. Removing it
+from HEAD does not remove it from history or from clones; the revocation is the
+fix. Routed to railiance-bootstrap and railiance-cluster (hub messages).
+
+### Benign (no action)
+
+| Pattern | Where | Why benign |
+| --- | --- | --- |
+| commit SHAs, sha256 digests, UUIDs | evidence and assessment JSON across the fleet | identifiers, not credentials |
+| Kubernetes `secret_uid`, `secret: <uid> <resourceVersion>` | key-cape, railiance-platform, the-custodian evidence | object metadata, not values (the KEY-WP-0011 exposure was handled then) |
+| `-----BEGIN PRIVATE KEY-----` | railiance-platform scripts and schema, net-kingdom console, ops-warden tests | header strings in detectors and validators; the ops-warden test body is `xxx` |
+| `kind: SecretStore` | net-kingdom, railiance-platform | store references, no data |
+| credential-shaped list | informed-decision `tests/test_intake.py` | redaction test fixtures (synthetic Bearer `abcd…`); owner to confirm when convenient |
+| dev defaults | key-cape `scripts/bootstrap-dev.sh` | `dev…` values for local development |
+| placeholders | ihp-railiance-probe docs (`<GIT…>`), markitect fixtures (`YOUR…`) | not values |
+| public material | net-kingdom age public key and `.sops.yaml` fingerprint | public by design |
+| signing-key identifiers | target-revenue `Ed25519…` key ids | identifiers, not private keys |
+| synthetic hashes | facetted-interfaces `history/FIAM_v0.2_Draft6` fixtures (106) | example data |
+
+## Limits
+
+- Only refs present locally. Server-only branches, tags not fetched, and forks
+  were not scanned.
+- Forgejo issues, pull-request comments, wikis, releases and package contents
+  were not scanned. Packages (container images) can contain secrets in their
+  layers; scanning them is a separate task if wanted.
+- gitleaks' default rules; a credential with no recognisable shape can be missed.
+- No validity check was made against any service.