2.2 KiB
Artifact and secret policy
The experiment should be reproducible from Git without placing household credentials, spatial maps or device secrets into normal Git history.
Sensitive by default
- Wi-Fi SSID and PSK;
- full K1 serial, BLE UUID, MAC/IP addresses and router client lists;
- provisioning payloads, tokens, nonces, certificates and session keys;
- PCAP/PCAPNG, Bluetooth logs and extracted flows;
- K1 logs,
project.json,.xbin, LAS/point clouds and trajectories; - camera frames, previews, panoramas and mapped interiors;
- command lines or shell history containing a credential.
Private Git is still durable replicated storage. Git LFS changes storage and size behavior; it does not provide confidentiality.
Commit to normal Git
- source, tests and lock-file;
- immutable reference documents and their hashes;
- schemas, runbooks, ADRs and redacted reports;
- synthetic or explicitly redacted fixtures;
- redacted manifests and SHA-256 inventories;
- commands needed to reproduce analysis from a locally supplied artifact.
Keep outside normal Git
.venv, local config and Keychain references;- actual credentials;
- real captures and decoded output;
- complete K1 project copies;
- unredacted device and router metadata.
Session integrity
Every real session should record:
- schema version and unique session ID;
- tool Git commit;
- UTC start/end and Mac monotonic start/end;
- masked device/host/network identities;
- physical state timeline;
- exact capture filter and interface;
- artifact path, size and SHA-256;
- redaction status and storage location classification;
- operator notes and final GO/PAUSE/BLOCKED decision.
Raw artifacts are never silently deleted by code. That does not imply infinite retention: capacity, encryption, backup and deliberate deletion policy are an operator decision outside the capture command.
Future provisioning secret input
The Wi-Fi password must not be accepted as a normal CLI argument. A reviewed provisioner should use a hidden prompt, stdin/file descriptor with strict permissions, or macOS Keychain. Logs and manifests record only that a credential was supplied, never its value or unredacted payload bytes.