1. balance-checker LaunchAgent exit 78. `clawstin.balance-checker` (hourly, runs `/Users/aicomputer/clawstin-app/server/balance-check-all.py`) exiting with code 78. Both stdout and stderr logs at `~/Library/Logs/clawstin-balance-checker*.log` are empty — the script crashes before producing output. Script exists at the expected path. Likely a runtime dependency issue (browser session cookies expired, missing module, etc). Brand new (installed in session 19 / 2026-03-09 01:43).
2. balance-notify LaunchAgent exit 1. `com.clawstin.balance-notify` (5x daily scraper → Signal). Log shows it started the 21:00 run on 3/8 but never completed — no "Done" entry. The scraper likely failed mid-run (browser tab/cookie issue). Last successful run: 18:26 on 3/8.
3. 3 cron jobs in error state. `morning-paper` (5:45 AM), `openclaw-update` (6:00 AM), and `update-check` (8:00 PM) all show status "error" in `openclaw cron list`. No `openclaw cron logs` command available to inspect details. morning-paper was fixed in session 4 (missing .html → 404) — may have errored again on a different issue.
4. triage.py OAuth token expired/revoked. Log entry at 2026-03-08 20:12:40: `invalid_grant: Token has been expired or revoked`. However, subsequent runs at 01:12 and 02:12 on 3/9 completed successfully — the token appears to have self-recovered or been refreshed. Monitor for recurrence.
5. SCHEDULE.md not chronologically sorted. The 2026-03-11 entry (Tori post office) appears after the 2026-07-18 entry (Jim Kelly Wedding). 4th consecutive audit flagging this.
6. Context load over threshold. Total word count across all auto-injected + startup-read files: 2,200 words (threshold: 1,500). Individual files over 400-word threshold:
- AGENTS.md: 643 words (auto-injected every session)
- memory/2026-03-08.md: 1,021 words (startup-read; 19 sessions drove this high)
Note: AGENTS.md was already optimized from ~1,900w → ~1,020w in session 6, then further. The 643w is post-optimization. The daily log is inherently large due to the unusually high session count (19). Tomorrow's log will start fresh.
Carried Over
1. SCHEDULE.md sort order — 4th consecutive audit.
2. MEMORY.md pending items from 2026-03-04 — 6 items Ghost marked "for MEMORY.md" still awaiting confirmation: Hellbot verification triple, $HINV replaces $HCOMP, parser number-name bug, legacy data boundary row 878+, positive SALE qty = returns, quarterly system refresh April 1. 3rd consecutive audit.
Resolved From Last Report
- clawstin-autonomous-spawner in ACTIVE/ — renamed to `openclaw-as-a-gift` in session 5. Project scope reframed. No longer a stale project concern.
- Fired ATS plists — both `clawstin.ats.tell-ski-hustle-dee` and `clawstin.ats.test-with-special-chars-symbols` fully unloaded (cleaned up in session 4, verified not in `launchctl list`).
- AGENTS.md IDENTITY.md/USER.md contradiction — the "Deleted Files — Do Not Recreate" section was removed in session 4.
Past-Due Schedule Entries
None. Next entries fire today (Mar 9): Hound Keyan 9:00 AM, AR mighty white 9:00 AM.
Fired One-Shot Reminders
None currently loaded.
Step Completion Checklist
Step 1 -- Pre-Audit Data: completed (11 checks, 0 errors, 2 warnings: LaunchAgents + log errors)
Step 2 -- Last Report Review: completed (3 carried-over items reviewed; 3 resolved)
Step 3 -- Daily Integration: completed (2026-03-08 log reviewed — 19 sessions; 2026-03-09 log does not yet exist; all session detail files referenced exist)
Step 4 -- Git Diff + Downstream: completed (19 commits; major work: balance monitoring infra, clawstin-app, project housekeeping; no stale references to old values found)
Step 5 -- File Health Review: completed (MEMORY.md 117w healthy; SCHEDULE.md sort issue; context load 2,200w over 1,500 threshold; AGENTS.md 643w over 400 threshold)
Step 6 -- Cron + Automation: completed (14 cron jobs; 3 in error state flagged; model assignments appropriate: Opus=autoaudit, Sonnet=security-guard/morning-brief/morning-paper/zero-token-heartbeat, Haiku=routine checks)
Step 7 -- Script Validation: completed (send-todo.sh, triage.py, triage-proton.py, watchdog.sh all exist at expected paths; balance-notify.sh exists; balance-check-all.py exists)
Step 8 -- Cross-File Consistency: completed (MEMORY.md refs to INDEX.md/CL.md verified; HEARTBEAT.md→HEARTBEAT-FULL.md verified; STYLE.md→STYLE-FULL.md verified; GUARDRAILS.md verified; Signal group IDs not re-verified — unchanged since last audit; SYNC.md at v411 matches latest commit)
Overall threat level: HIGH
This patrol identified 9 findings, of which 2 are severity 9 (CRITICAL). The most urgent issues are:
1. Plaintext credentials across the entire `lifeboat-system/` directory — API keys, OAuth tokens, tunnel secrets, encryption keys, and Google Drive refresh tokens — all stored in workspace files that are NOT gitignored.
2. The lifeboat zip password is hardcoded in at least 13 locations across markdown files in the git-tracked workspace, alongside the Twilio recovery code.
Findings from the 2026-03-08 report remain unresolved.
CRITICAL FINDINGS
SG-2026-03-09-001: Lifeboat-System Contains Full Credential Suite in Plaintext
Severity: 9Rubric reference: Credential Exposure — "Plaintext credentials stored insecurely... accessible locally without privilege"
Evidence — files containing plaintext secrets:
| File | Credential Type |
|------|----------------|
| `lifeboat-system/openclaw-config/openclaw.json` line 7 | Anthropic API key (mislabeled as OPENAI key) |
| `lifeboat-system/gmail-tokens/credentials.json` | Google OAuth client secret |
| `lifeboat-system/gmail-tokens/token-clawstinai.json` | Google OAuth access token + refresh token |
| `lifeboat-system/gmail-tokens/token-krspamgang.json` | Google OAuth access token + refresh token |
| `lifeboat-system/gmail-tokens/token-adalsey.json` | Google OAuth access token + refresh token |
| `lifeboat-system/cloudflared/[tunnel-id].json` | Cloudflare tunnel secret (base64) |
| `lifeboat-system/cloudflared/cert.pem` | Cloudflare origin certificate |
| `lifeboat-system/den/fernet-key.b64` | MASTER Den encryption key |
| `lifeboat-system/den/creds.enc` | Encrypted credential store |
| `lifeboat-system/rclone/rclone.conf` | Google Drive OAuth tokens for 2 accounts |
| `lifeboat-system/signal-data/535318` | Signal protocol key material |
Why this is severity 9:
- The `lifeboat-system/` directory has no `.gitignore` entry. The workspace root `.gitignore` only excludes `node_modules` and `.netlify`.
- The Fernet key file is the master decryption key for The Den. With it + `creds.enc`, every secret is unlocked.
- The rclone config contains live Google Drive OAuth tokens for two accounts.
- All files sit in the git-tracked workspace, readable by any subagent or tool with workspace access.
- Git repo has no remote (confirmed: `.git/config` has no `[remote]` section), preventing accidental push, but this is a fragile protection.
Impact: Compromise of any workspace-reading component yields: Anthropic API key, Gmail access (3 accounts), Cloudflare tunnel control, Google Drive access, Signal account data, and the master Den key (which unlocks Twilio, admin password, etc).
Commands run:
- `grep -l "Anthropic key prefix" lifeboat-system/...` — hit on openclaw-config/openclaw.json
- `head -3` on each token file — confirmed OAuth tokens present
- `cat` on cloudflared JSON — confirmed tunnel secret present
- `head -2` on fernet-key.b64 — confirmed base64 key present
- `cat` on rclone.conf — confirmed full OAuth tokens for 2 Google Drive remotes
- `ls -la lifeboat-system/.gitignore` — No such file
- `cat .gitignore` — only node_modules and .netlify
Recommended action:
1. Move `lifeboat-system/` out of the git workspace entirely (e.g., to `~/.openclaw/lifeboat-staging/`)
2. Add `lifeboat-system/` to `.gitignore` immediately as a stopgap
3. Rotate the Anthropic API key (exposed since at least 2026-03-06)
4. Consider whether the Fernet key should ever exist as a file in the workspace
SG-2026-03-09-002: Passwords and Recovery Codes Hardcoded in 13+ Markdown Files
Severity: 9Rubric reference: Credential Exposure — "Plaintext API key or password exposed"
Evidence — the lifeboat zip password appears in these files:
| File | Occurrences |
|------|-------------|
| `LIFEBOAT.md` line 71 | 1 — "Encrypted zip password: [REDACTED]" |
| `CREDENTIALS.md` line 57 | 1 — "Zip password: [REDACTED]" |
| `RESTORE.md` lines 78-79, 241 | 3 — inline in unzip commands |
| `memory/2026-03-06.md` line 133 | 1 — "accessed the Den with password [REDACTED]" |
| `memory/2026-03-05.md` line 17 | 1 — "Password confirmed: [REDACTED]" |
| `memory/session-log-2026-03-02-141041.txt` | 8 — VNC password, zip password, conversation |
| `PROJECTS/COMPLETE/repair-google-drive-2026-03-05.md` | 1 |
| `PROJECTS/reference/coastguard-full.md` lines 86-87 | 2 — table with zip + openssl passwords |
Additionally — Twilio recovery code appears in:
- `CREDENTIALS.md` line 21 (1 occurrence)
- `memory/2026-02-24.md` lines 78, 92 (2 occurrences)
Commands run:
- `grep -rn` for the password value across `--include=".md" --include=".txt" --include="*.json"` — 16+ matches
- `grep -rn` for the Twilio recovery code prefix — 3 matches in 2 files
Why this is severity 9:
- The password is reused for: lifeboat zip encryption, openssl encryption, and was used as VNC login password.
- The Twilio recovery code is a one-time secret that should never be stored in multiple plaintext locations.
- All files are git-tracked. The session log alone has 8 repetitions.
- Even scrubbing files will not remove from git history.
Recommended action:
1. Move all passwords to The Den exclusively — reference by key name only in docs
2. Scrub the password from all .md files
3. Purge or gitignore session logs containing raw passwords
4. Rotate the lifeboat password (current one is burned into git history)
5. Rotate Twilio recovery code if possible
HIGH FINDINGS
SG-2026-03-09-003: Anthropic API Key in Session Logs (REPEAT from 2026-03-08)
Severity: 8Rubric reference: Credential Exposure — "Stale credentials with potential lateral movement impact"
Evidence:
- `memory/session-log-2026-03-03-095158.txt` — 3 occurrences of a full Anthropic API key inline in shell commands
- `memory/2026-03-06-1922.md` — references to placeholder key values (lower risk)
- `memory/2026-03-06-1839.md` — references to placeholder key values
Note: The key in the session log appears to be DIFFERENT from the key in lifeboat-system config. Two distinct keys may be exposed.
Status: UNRESOLVED from 2026-03-08 report.
Recommended action: Rotate both keys. Scrub the session log. Add session logs to .gitignore.
SG-2026-03-09-004: API Key in REDDIT-UPGRADES Step File (REPEAT from 2026-03-08)
Severity: 6File: `REDDIT-UPGRADES/step-03.md` — 1 occurrence of Anthropic key prefix inline in shell command example.
Status: UNRESOLVED from 2026-03-08 report.
Recommended action: Replace with placeholder or env var reference.
Severity: 5Rubric reference: Network Exposure — "Internally exposed services"
Evidence (from `ps aux`): PID 1505 — `remoting_me2me_host` running with host config and SSH auth socket at `/tmp/chromoting.aicomputer.ssh_auth_sock`.
Detail: Provides full desktop access to anyone with the Google account + PIN. The SSH auth socket in /tmp is a local attack surface for SSH agent hijacking.
Recommended action: Accept as known risk if intentional. Add to accepted-risks.md.
SG-2026-03-09-006: Cloudflare Tunnel Exposes 3 Local Services to Internet
Severity: 5Rubric reference: Network Exposure
Evidence (from cloudflared config):
- `clawstin.org` routes to `localhost:8877`
- `voice.clawstin.org` routes to `localhost:3334`
- `webhook.clawstin.org` routes to `localhost:18789`
- Catch-all returns 404
Cloudflared is running (PID 1487). The webhook endpoint receives external triggers into the openclaw gateway.
Recommended action: Verify all endpoints have proper authentication. Accept as known risk if verified.
LOW / INFORMATIONAL
SG-2026-03-09-007: .gitignore Is Minimal
Severity: 4
Only excludes `node_modules` and `.netlify`. Does not exclude `lifeboat-system/`, session logs, state files, credential files. A `git remote add` + `git push` would expose everything.
Recommended action: Add comprehensive exclusions.
SG-2026-03-09-008: Git Repo Is Local-Only (No Remote)
Severity: 2 (Positive finding)
`.git/config` has no `[remote]` section. This prevents accidental credential push but is a fragile protection.
SG-2026-03-09-009: Ollama Running Locally
Severity: 2 (Informational)
PID 1511. Typically localhost:11434. No evidence of external exposure.
SYSTEM STATUS
| Component | Status | Notes |
|-----------|--------|-------|
| LuLu Firewall | Running | PID 1491 (app) + PID 699 (system extension) |
| Cloudflared | Running | PID 1487, tunnel: clawstin |
| Tailscaled | Running | PID 655 (root) |
| OpenClaw Gateway | Running | PID 78504 |
| Ollama | Running | PID 1511 |
| Chrome Remote Desktop | Running | PID 1505 |
| Proton Mail Bridge | Running | PID 1501 |
| World-writable files | None found | |
| Stray creds in /tmp | None found | |
| JWT tokens in logs | None found | |
| npm audit | Not run | Blocked by sandbox |
| FileVault | Not checked | fdesetup blocked |
| Auth logs | Not checked | Not accessible |
| Port enumeration | Not run | lsof not in sandbox PATH |
Threat Landscape (External)
Internet checks (NVD, Node.js advisories, macOS bulletins) could not be performed — sandboxed environment, no network access.
Ghost should manually check:
- NVD for recent CVEs affecting Node.js, macOS, Cloudflare
- Node.js security page for new advisories
- Apple security updates for macOS patches
Risk Acceptance Notes
No findings match entries in `security-guard-accepted-risks.md` (no accepted risks yet).
Comparison to Previous Report (2026-03-08)
| Finding | 2026-03-08 | 2026-03-09 | Status |
|---------|-----------|-----------|--------|
| API keys in memory markdown | Sev 8 | Sev 8 (SG-003) | UNRESOLVED |
| Mislabeled key in lifeboat config | Sev 7 | Escalated to Sev 9 (SG-001) | ESCALATED |
| Key in REDDIT-UPGRADES | Sev 6 | Sev 6 (SG-004) | UNRESOLVED |
| flock not installed | Sev 3 | N/A | Likely resolved |
| netstat/lsof unavailable | Sev 2 | Still blocked | Persists |
| Tailscale "not running" | Noted | Running (PID 655) | RESOLVED |
New this run: SG-001 (lifeboat credential suite), SG-002 (passwords in markdown), SG-005 (Chrome Remote Desktop), SG-006 (Cloudflare tunnel), SG-007 (minimal gitignore)
Report generated: 2026-03-09 03:32 EDTNext patrol: 2026-03-10