Sprint 2026-W46 (security phase-2 track): ready split items from the #3339/#3342/#3346 re-verification #3634

Goal

The six ready phase-2 security items from the #3339, #3342 and #3346 re-verification are fixed, with the owner's defaults. Items that need a decision stay parked.

Phase 2 — ready (defaults accepted by the owner, 2026-11-11)

• helm: host-key checking defaults to secure; the ignore-host-key fallback becomes an error #3628 helm: host-key checking defaults to secure — size S, sonnet
• CLI: secret input via --token-file and --stdin; keep --token with a warning #3629 CLI: --token-file and --stdin, keep --token with a warning — size M, sonnet
• usernames and collaborator names: reject the -container- infix at creation, with one shared validator #3630 naming rule: reject the -container- infix at creation — size S, sonnet
• Caddy build and unit: predictable /tmp build path and credential in --environ #3631 Caddy build path and --environ credential exposure — size S, sonnet
• one secret-file writer: create 0600, then chmod; migrate mtls key, pool-join and service writers #3632 one secret-file writer, 0600 on create — size M, sonnet
• scanner rerun: locate symlink-following and heredoc-before-chmod sites, pinned to a commit #3633 scanner rerun for symlink and heredoc sites, pinned to a commit — size S, sonnet

Follow-up — filed after the #3633 scan (added to this sprint)

• Root chown -R on the Caddy data tree follows a symlink planted by the caddy user #3669 Caddy data tree: root chown -R follows a planted symlink — size S, sonnet
• In-box root chown/mkdir on user-owned paths: decide whether box-internal root is a trust boundary #3670 in-box root chown/mkdir on user paths — needs-decision (is box-internal root a trust boundary?), size M, sonnet
• In-box secret files written before their chmod: lc-creds, stacks tee, and the workspace token #3671 in-box secret files written before their chmod (lc-creds, stacks tee, workspace token) — size S, sonnet
• Tunnel token out of the systemd unit's ExecStart: EnvironmentFile or --token-file #3672 tunnel token out of ExecStart (EnvironmentFile or --token-file; CLI: secret input via --token-file and --stdin; keep --token with a warning #3629 merged) — size S, sonnet

Parked — waiting on a decision (not in this sprint)

• security: tenant/identity derived from name strings or guest-reported values #3339 cluster identity: immutable id and re-mint for READY clusters (needs the dual-accept window)
• security: tenant/identity derived from name strings or guest-reported values #3339 guest-reported IPs: hard failure per box or per pass (needs the owner's call)
• security: tenant/identity derived from name strings or guest-reported values #3339 TTL for box CRs: grandfathering of existing CRs (needs the owner's call)
• security: secret handling — argv, file modes, predictable /tmp, symlink-following #3342 Caddy DNS credential migration (default: rewrite on next provision, not yet confirmed)
• security: secret handling — argv, file modes, predictable /tmp, symlink-following #3342 /tmp/agent-box log directory: clients may read the path (default: keep path, add per-user subdirectory)
• security: unbounded or quadratic work on tenant-controlled input #3341 byte cap and deadline (default 16 MiB and 60 s, not yet confirmed)

Open questions

None open for the ready items. Each child carries the default the owner accepted.

Verification queue

Critical path

None. The six items are independent.

Cadence

Progress comments on this issue. Definition of done: each ready child merged with green CI; the verification row is carried to the release pass.

Status

Scoped. Nothing claimed yet.