# Deployment facts and live-test plan

## MeshCentral deployment

- Hostname: `mesh.ledrew.me`
- Internal address: `10.10.10.177:80`
- Reported version: `1.2.5`
- Location: LXC on PVE2
- Installation method: Proxmox Community Scripts MeshCentral installer
- Test endpoint: `PVE3`
- Integration account: `sa_clawdia`

## Secret handling

The integration password was provided out-of-band in the project conversation and is intentionally **not stored in this repository, project files, logs, command lines, or agent prompts**. The real adapter must receive it through a protected runtime secret mechanism, such as a root-readable `0600` environment file or equivalent secret store.

If the credential is ever committed, logged, pasted into a command, or exposed to an unintended audience, rotate it immediately in MeshCentral.

## Live-test prerequisites

Before connecting:

- Confirm that `mesh.ledrew.me` is intended to resolve/reach the internal MeshCentral service from the proposed bridge host.
- Determine whether the reported port 80 is plain HTTP behind a reverse proxy and whether the MeshCentral control channel is available at the corresponding `/control.ashx` WebSocket endpoint.
- Verify the certificate/trust path if the control channel uses TLS; never disable certificate validation.
- Confirm `sa_clawdia` has only the required read-only permissions for the first test.
- Confirm `PVE3` is the sole target allowlisted for the first live test.
- Use only read-only operations: authentication/health check, server version, device groups, device inventory, and selected device metadata.
- Capture no password or session token in logs.

## Security Hardening Status

- **Concurrency & Rate Limits**: 5 concurrent requests max; token-bucket rate limiter applied to all outbound requests.
- **Audit Redaction**: Structured audit logs automatically redact secrets (base64, hex, known key patterns) and never capture credentials.
- **Verification**: 90/90 tests pass; TypeScript build passes with no errors; ESLint passes with no warnings.
- **Remaining Live-Test Gates**: See TODO.md for the operational checklist. Rob authorized read-only project access on 2026-08-26; no additional per-test approval is required, but all scope and stop conditions remain mandatory.
- **Rollback Rules**: If rollback is required: stop service immediately, rotate integration credential in MeshCentral, review audit logs, and document incident.

## Authorization checkpoint

A live connectivity test is authorized under Rob's project-level read-only access decision on 2026-08-26. The authorization covers only the documented read-only operations and PVE3 target; it does not cover commands, diagnostics, or state changes.