id,consumer,type,schedule_trigger,credential_arm,credential_source,endpoint_action,capability_rwx,live_evidence,criticality,current_failure_mode,classification,proposed_migration,config_or_container_to_change,expected_restart,rollback,operator_time,elapsed_time,blocker,confidence C01,incomex-nuxt (SSR web app; Directus service client),container,always-on (per SSR request),static token = admin,compose env NUXT_DIRECTUS_SERVICE_TOKEN=${DIRECTUS_ADMIN_TOKEN} <- /opt/incomex/docker/.env,"Directus REST .with(staticToken); serves /api/registry/, /api/discovery/relations, /api/transitive/[code]; workflows read + updateWorkflowRecord",R registry/discovery/transitive collections; R+W workflows,"token sha12=4d1f0a095ab6 == admin (live); 103 nginx hits (NUXT-403-R1); updateWorkflowRecord x4 in nitro.mjs (measured 2026-07-21)",CRITICAL,none (working); token==admin so token rotation breaks it,LIVE_LOAD_BEARING,"create non-admin nuxt-service identity (R registry/discovery/transitive + R/W workflows); add NUXT_SERVICE_TOKEN to docker/.env; change compose L174 to ${NUXT_SERVICE_TOKEN}; recreate nuxt",docker/.env + docker-compose.yml L174 + recreate incomex-nuxt,YES (1 recreate),revert compose L174 to ${DIRECTUS_ADMIN_TOKEN} + recreate,~0.5h (excl NUXT-IMG-H1),gated by NUXT-IMG-H1,NUXT_IMAGE_RECREATE_READY=NO (registry pull denied; :latest mutable; local-only digest 72715a),HIGH C02,incomex-agent-data (KB backend; directus_sync),container,always-on; sync listener on events,static token = admin,env_file /etc/incomex/agent-data.env : DIRECTUS_ADMIN_TOKEN (value == admin),"directus_sync.py:159 Authorization: Bearer {DIRECTUS_ADMIN_TOKEN}; measured verbs GET x16, DELETE x1 on Directus /items/",R (synced collections; GET x16) + DELETE (targeted x1),"token sha12=4d1f0a095ab6 == admin (live); event_system.py:463 registers sync iff token set; app up 3d healthy",HIGH,none; token rotation breaks directus_sync,LIVE_LOAD_BEARING,"create agent-data-sync identity (R synced collections + DELETE those); update agent-data.env token; docker save image backup THEN recreate agent-data",/etc/incomex/agent-data.env + recreate incomex-agent-data,YES (1 recreate),restore agent-data.env token + recreate,~0.5h,~1h (incl verify),none (image pinned+local; back up image first),HIGH (usage) / MED (exact collection set is dynamic) C03,reconcile-tasks (cron -> wrapper -> docker exec agent-data python3),host cron -> container exec,0 /6 * * * (every 6h),admin password (login),/etc/incomex/reconcile/directus-admin.env : DIRECTUS_PASSWORD (C1 protected root:600) -> docker exec -e,"reconcile-tasks.py: POST /auth/login then /items/tasks, /items/task_comments",R+W tasks; R+W task_comments,"log 2026-07-21 06:00 '10 synced, All in sync'",MEDIUM,none; password rotation -> login fails; CONTRIBUTES TO 25-fail lockout,LIVE_LOAD_BEARING,"reconcile-writer identity (prefer token) R/W tasks+task_comments+knowledge_documents; switch reconcile-.py to token OR replace DIRECTUS_PASSWORD in protected file",/etc/incomex/reconcile/directus-admin.env (+ optional reconcile-*.py auth),NO,restore protected env file,~0.25h (both reconcile jobs),~0.25h,none,HIGH C04,reconcile-knowledge (cron -> wrapper -> docker exec agent-data python3),host cron -> container exec,0 */6 * * * (every 6h),admin password (login),/etc/incomex/reconcile/directus-admin.env : DIRECTUS_PASSWORD,"reconcile-knowledge.py: POST /auth/login then /items/knowledge_documents (x3)",R+W knowledge_documents,"log 2026-07-21 06:00 'All in sync'",MEDIUM,none; password rotation -> login fails; lockout contribution,LIVE_LOAD_BEARING,covered by reconcile-writer identity (shares protected file),/etc/incomex/reconcile/directus-admin.env,NO,restore protected env file,shared with C03,shared,none,HIGH C05,dot-collection-health (cron),host cron,0 4 * * *,admin password (login -> DOT_TOKEN) to CLOUD Directus,cron-env.sh sources docker/.env (DIRECTUS_ADMIN_EMAIL/PASSWORD) + dot/config/environment.sh,"environment.sh /auth/login -> curl POST BASE_URL/items/system_issues (Bearer DOT_TOKEN)",R + W system_issues,"log 2026-07-21 04:00 '17 checks, compliance 96%'; bin L64-65 curl /items/system_issues Bearer",LOW,none; password rotation -> login fail; lockout contribution,LIVE_NONCRITICAL,"dot-observer token identity (R/W system_issues); arm cron line/environment.sh with new DIRECTUS_ADMIN_TOKEN (scoped)",docker/.env or cron line env or environment.sh,NO,revert env,~0.25h (both dot-health jobs),~0.25h,none,HIGH C06,dot-apr-health (cron),host cron,30 4 * * *,admin password (login -> DOT_TOKEN) to CLOUD Directus,cron-env.sh -> docker/.env + environment.sh,"POST BASE_URL/items/system_issues (Bearer DOT_TOKEN); also PG reads",R + W system_issues,"dot-apr-health.log shows APR stats (expired|38 rejected|14 approved|2 pending|1); bin L68-69 curl Bearer",LOW,none; password rotation -> login fail; lockout contribution,LIVE_NONCRITICAL,covered by dot-observer identity,docker/.env / environment.sh,NO,revert env,shared with C05,shared,none,HIGH C07,dot-dot-coverage (cron),host cron,0 2 * * 0 (Sun),admin password (armed),cron-env.sh -> docker/.env + environment.sh,"bin sources environment.sh; measured psql x2, no static /items/ curl found in bin",R (mostly PG; API usage unconfirmed),"log 2026-07-19 02:00 '[OK] Coverage report complete'",LOW,none; API dependency unconfirmed,LIVE_NONCRITICAL,"verify API usage in S1; if API -> fold into dot-observer; if PG-only -> remove vestigial password export",docker/.env / cron line,NO,revert env,~0.1h,~0.1h,minor-unknown (confirm API vs PG in S1),MED C08,dot-dot-health (cron),host cron,0 3 * * *,admin password (armed) BUT VESTIGIAL,cron-env.sh -> docker/.env,"measured api_refs=0, psql=4 -> PURE PG (docker exec postgres psql)",R (PG only),"log 2026-07-21 03:00 (runs; reports FAIL_CRITICAL in DATA, not auth)",LOW,none; rotation does NOT break it (PG-direct),BROKEN_NOT_A_CONSUMER (of the credential),hygiene: remove dead DIRECTUS_ADMIN_EMAIL/PASSWORD export from crontab,crontab line (hygiene only),NO,restore crontab line,~0.1h,~0.1h,none,HIGH C09,dot-orphan-scanner (cron),host cron,30 2 * * ,DIRECTUS_ADMIN_TOKEN (armed) BUT VESTIGIAL,cron 'export DIRECTUS_ADMIN_TOKEN' <- docker/.env,"bin L40 PG=docker exec postgres psql; SELECT meta_catalog; INSERT approval_requests (all via PG). token NOT referenced in bin",R+W via PG (approval_requests); no Directus API,"log 2026-07-21 02:30 (runs; scan output)",LOW,none; rotation does NOT break it,BROKEN_NOT_A_CONSUMER (of the credential),hygiene: remove dead DIRECTUS_ADMIN_TOKEN export from crontab,crontab line (hygiene only),NO,restore crontab line,~0.1h,~0.1h,none,HIGH C10,dot-misclass-scanner (cron),host cron,0 3 * * 0 (Sun),DIRECTUS_ADMIN_TOKEN (armed) BUT VESTIGIAL,cron 'export DIRECTUS_ADMIN_TOKEN' <- docker/.env,"bin L33 PG=docker exec postgres psql; INSERT approval_requests via PG; token NOT referenced",R+W via PG (approval_requests); no Directus API,"log 2026-07-19 03:00 'RESULTS: 0 issues'",LOW,none; rotation does NOT break it,BROKEN_NOT_A_CONSUMER (of the credential),hygiene: remove dead token export from crontab,crontab line (hygiene only),NO,restore crontab line,~0.1h,~0.1h,none,HIGH C11,dot-apr-execute (cron),host cron,/5 * * * ,admin password + SYNC_SECRET,cron-env.sh -> docker/.env (DIRECTUS_ADMIN_EMAIL/PASSWORD + SYNC_SECRET),"dies Phase 1: curl (7) Failed to connect to localhost:8055 (port NOT published to host)",n/a,"apr-execute.log 9.1M of repeated curl(7); mtime 2026-07-21 08:05",NONE (dead),ARCHITECTURALLY BROKEN (hardcoded localhost:8055 unreachable from host),BROKEN_NOT_A_CONSUMER,"separate fix (point at directus service URL) OR retire; ALSO resolve SYNC_SECRET==admin-token coupling",dot-apr-execute bin + docker/.env SYNC_SECRET,NO,n/a,out-of-scope (separate ticket),n/a,"not blocking C2B1; but SYNC_SECRET==token must be decoupled before/with rotation",HIGH N01,incomex-claude-mcp (MCP server),container,always-on,tac-agent static token (NON-admin),env DIRECTUS_TOKEN (sha12=705486aaa3bf = tac-agent user bd532ff2, policy tac-agent-policy admin_access=f),Directus API as tac-agent,per tac-agent-policy,"token sha12=705486aaa3bf == tac-agent (live)",n/a,none; admin rotation does NOT affect it,NON_CONSUMER (of admin),none required,none,NO,n/a,0,0,none,HIGH N02,BALO Administrator role-ID dependency,config/logic,on BALO one-click sync,role-ID reference a40a1070 (Administrator),Nuxt/BALO env expecting Administrator role id,uses Administrator role id for gating,role-id read,"role a40a1070 = Administrator (live); BALO memory balo-postaccept",MEDIUM,"role-ID is stable across password/token rotation (rotation changes secret, NOT role id)",LIVE_NONCRITICAL (not a credential consumer),"no action for rotation; role id a40a1070 is unchanged by C2B1-X. If BALO writes need a non-admin identity, fold into nuxt-service (S1)",none for rotation,NO,n/a,0 (rotation) / S1 review,0,none for rotation,MED D01,"DOT manual admin tools (dot-auth, dot-backup, dot-clean-data, dot-env-backup/restore, dot-fix-permissions, dot-permissions-setup, dot-schema-apply, dot-seed-agency-os, dot-spider, dot-token, dot-web28-complete)",host CLI (manual/occasional),on-demand (NOT in crontab),admin password/token via environment.sh,dot/config/environment.sh <- docker/.env,various admin API ops (legit human-operator admin surface),admin (by design),"grep: reference ADMIN_PASSWORD/TOKEN; none scheduled in crontab",MEDIUM,none; these auto-follow docker/.env,DORMANT (operator admin tools),"NO decomposition: keep on rotated admin credential; they ARE the human admin surface, out of machine-consumer scope. They auto-pick new value from docker/.env after rotation",none (follow docker/.env),NO,n/a,0,0,none,HIGH H01,"7 suspended agent. users (agent.antigravity, agent.chatgpt, agent.claude_code_cli, agent.claude_desktop, agent.codex_cli, agent.gemini_cli, agent.gemini)",Directus users,n/a,own 32-char tokens,directus_users.token (each distinct),cannot authenticate (status=suspended),none,"status=suspended (measured all 7)",NONE,dead accounts,HISTORICAL_ONLY,"none for C2B1; optional cleanup (delete tokens) in later hygiene pass",none,NO,n/a,0,0,none,HIGH