C2B1-R0 — Executive Verdict — Bootstrap Admin Consumer Map, Recreate Readiness & Containment-Path Decision

• Generated (UTC): 2026-07-21T06:17:37Z
• Mode: Production READ-ONLY (absolute). Zero mutation. See 08-no-mutation-proof.md.
• Author: Claude Code (Opus 4.8, 1M ctx)
• Predecessors read/carried: C2A rotation-readiness (2026-07-18), NUXT-403-R1 (2026-07-20), C1 hardcode-removal (2026-07-17), C2B-PRE/F1/V3 (2026-07-19→21), Wave-A1 agent-data (2026-07-17), post-migration survey (2026-07-17).

---

VERDICT

VERDICT              = PASS_C2B1_R0_DECISION_READY
GATING_SUBHOLD       = NUXT_IMAGE_RECREATE_READY = NO
                       -> NUXT-IMG-H1 is MANDATORY before C2B1-S3 (Nuxt repoint)
                       -> and therefore before C2B1-X (admin password+token rotation)
C2B1_ROTATION        = HOLD (unchanged — rotation still NOT safe today)
RECOMMENDED_PATH     = OPTION B (DIRECT DECOMPOSITION), sequenced file-consumers-first

R0 successfully answers all four mandated questions with live measurement. The decision is ready. The single hard downstream gate (Nuxt image cannot currently be safely re-pulled/recreated) is characterized and assigned to phase NUXT-IMG-H1. It does not block R0, S1-DESIGN, S1-APPLY, or S2 — only the Nuxt repoint (S3) and the final rotation (X).

TL;DR (tiếng Việt)

• Ai còn dùng bootstrap admin? Thực chất chỉ 2 container dùng static token admin còn sống: Nuxt (token NUXT_DIRECTUS_SERVICE_TOKEN = CHÍNH token admin 4d1f0a095ab6, 103 hit live) và agent-data (directus_sync.py gọi Bearer bằng token admin). Bốn job host dùng password (2× reconcile, dot-collection-health, dot-apr-health) — sửa bằng cách sửa file, KHÔNG restart. Hai scanner (orphan/misclass) tuy được cấp token trong crontab nhưng KHÔNG dùng (chạy docker exec postgres psql thẳng) ⇒ token là rác/vestigial. dot-apr-execute HỎNG (curl 7). claude-mcp dùng tac-agent (không phải admin).
• Chặn lớn nhất: ảnh Nuxt là :latest mutable và registry KHÔNG với tới được từ VPS (Artifact Registry API disabled cho project 812872501910). Ảnh đang chạy chỉ tồn tại trong cache docker local (digest 72715a92885c). ⇒ recreate mà có pull sẽ gãy; không có bản offsite.
• Phát hiện mới 🔴: SYNC_SECRET trong docker/.env byte-identical với token admin (cùng sha 4d1f0a095ab6) — trùng lặp bí mật ngoài ý muốn (dùng bởi dot-apr-execute đang hỏng).
• Khuyến nghị: chọn Direct Decomposition (Option B), làm các consumer file trước (gỡ ngay phần lớn blast-radius, không lockout), chạy NUXT-IMG-H1 song song, rồi repoint Nuxt, rồi xoay admin. Fast Containment KHÔNG nhanh hơn tới đích (cùng vướng cổng Nuxt) mà lại đẻ thêm 1 token rộng phải quản.

---

The four questions (answers)

Q1 — Which machine consumers use the bootstrap admin password/token/session/role-ID? Live token equality re-confirmed (sha12 4d1f0a095ab6, len 64) across DB user 6abdec55 (admin@example.com, role Administrator a40a1070, policy 8a613123 admin_access=t), docker/.env:DIRECTUS_ADMIN_TOKEN, Nuxt NUXT_DIRECTUS_SERVICE_TOKEN, agent-data DIRECTUS_ADMIN_TOKEN, and docker/.env:SYNC_SECRET.

• Real TOKEN consumers (break on token rotation): incomex-nuxt, incomex-agent-data.
• Real PASSWORD consumers (break on password rotation): reconcile-tasks, reconcile-knowledge, dot-collection-health, dot-apr-health (login → cloud Directus). (dot-dot-coverage low-confidence.)
• Armed-but-vestigial (NOT real consumers): orphan-scanner, misclass-scanner (token export unused; PG-direct), dot-dot-health (password export unused; PG-direct).
• Broken (not a consumer): dot-apr-execute (curl 7, localhost:8055 not published).
• Non-admin (unaffected): claude-mcp (uses tac-agent token 705486aaa3bf).
• Role-ID dependency: BALO Administrator role-ID a40a1070 — see note in 01-consumer-register.csv. See 01-consumer-register.csv.

Q2 — What capability does each need? No consumer needs admin-surface (users/roles/policies/ permissions/settings/schema-DDL). Envelopes are narrow content R/W. See 02-capability-map.csv.

Q3 — How to migrate & rollback each? File consumers = edit a protected env file, no restart, instant rollback. Container consumers = swap token var + recreate (agent-data OK today; Nuxt gated). See 01-consumer-register.csv + 03-recreate-readiness-matrix.csv.

Q4 — Fast Containment vs Direct Decomposition? See 06-time-risk-comparison.md. Recommendation: Option B, sequenced. Both options share the Nuxt gate, so Fast Containment buys no time-to-rotation; Option B reaches least-privilege without a throwaway broad token.

Working-state deltas vs prior missions

BACKUP_RECOVERABILITY        = PASS               (unchanged)
C2B1_ROTATION                = HOLD               (unchanged)
NUXT_ADMIN_TOKEN_DEPENDENCY  = LIVE               (re-confirmed, sha12 4d1f0a095ab6)
NEW: AGENT_DATA_TOKEN_DEPENDENCY = LIVE           (directus_sync.py Bearer — confirmed in-code)
NEW: SYNC_SECRET == ADMIN_TOKEN (byte-identical)  (accidental secret duplication)
CORR: orphan/misclass scanners are PG-direct      (their token export is vestigial, NOT a consumer)
CORR: agent-data image landmine FIXED             (compose L130 pins agent-data-vps-prod:9acd...-20260717)
NEW: NUXT_IMAGE_RECREATE_READY = NO               (registry pull DENIED from VPS; local-only digest)

Immediate next phases (unchanged from mission plan, now grounded)

C2B1-S1-DESIGN → C2B1-S1-APPLY (provision, no repoint) → C2B1-S2 (capability + negative verify) → NUXT-IMG-H1 (pin + docker save + prove recreate — REQUIRED) → C2B1-S3 (repoint per consumer) → C2B1-R1 (prove machine-dependency-on-admin = 0) → C2B1-X (rotate password+token) → C2B1-V (post-rotation encrypted backup + restore).

STOP after report. No provision, repoint, restart, or rotate performed.