no rotation needed: nobody else has ever used this install

the owner confirmed the additional accounts are test rows - none has ever
signed in, no member has opened a shell or a chat. so the proxy secret was
readable by accounts that do not exist in practice, and there is nothing to
rotate.

the mode fix stands: it is about the install that gets used, not this one.
dropping the TODO and recording the reasoning instead, because a rotation item
left sitting there reads as outstanding work forever, and the next person to
find a world-readable secret should ask who uses the box before reaching for
the alarm.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TODO.md

@@ -402,30 +402,6 @@ outside the example's new README:
 
 ## Waiting on the owner to run it
 
-- [ ] **Rotate the Anthropic proxy secret on the production host.** The file modes are fixed in code
-      (`state.ts` writes 0600, `secureRuntimeSecrets()` sweeps every boot) and were repaired on the dev box
-      — but `data/sidecar/claude-state.json` was world-readable for the whole life of the install, so any
-      account that read it still holds a key to the owner's Claude Max subscription. **A chmod closes the
-      door; it does not change the lock.**
-
-      On the production host — which is the one with six accounts and real members — this matters and the
-      dev box does not.
-
-      ```bash
-      pm2 restart officer                    # runs the sweep; check the log for what it closed
-      # then rotate:
-      #   stop officer-anthropic-proxy, clear "proxySecret" in data/sidecar/claude-state.json, start it
-      pm2 restart officer-anthropic-proxy officer-claude-code
-      ```
-
-      **Both sidecars, together.** `officer-claude-code` caches the secret in `process.env.ANTHROPIC_API_KEY`
-      (`ensureAnthropicEnv` returns early once it is set), so rotating the proxy alone makes every chat turn
-      401 until the agent sidecar is also restarted.
-
-      Worth checking while there: `ls -la $OFFICER_ROOT/data/sidecar/` on production, and whether any member
-      account has a shell history or a `~/.claude/settings.json` naming `ANTHROPIC_BASE_URL` — that would be
-      evidence someone actually used it, rather than merely could have.
-
 - [ ] **Plan mode is built and has never executed.** Landed `1b811dfa` on 2026-08-17, typechecks, unit
       tested at the translation layer — and not one line of it has run on a machine. The owner was away
       when it was finished and asked to be reminded, which is what this entry is.

docs/per-user-linux-accounts.md

@@ -117,10 +117,20 @@ above. The line is who created the file: `.env` is the installer's and Officer m
 this is Officer's own output at the machine's umask — a wrong mode there is Officer's bug, and bricking the
 platform over it would punish the user for our mistake.
 
-**A chmod does not undo exposure.** Any account that read the secret while it was open still holds it, and
-it does not expire. Rotating it means clearing `proxySecret` and restarting `officer-anthropic-proxy` —
-and then `officer-claude-code`, which caches the value in `process.env.ANTHROPIC_API_KEY` and will 401 on
-every turn until it re-reads. Restart both or neither.
+**No rotation was needed, and that is a fact about this install rather than about the bug.** A chmod closes
+the door without changing the lock — anyone who read the secret while it was open still holds it, and it
+does not expire. But the owner confirmed on 2026-08-17 that nothing here has ever been used by anyone else:
+the additional accounts were created for testing, none has ever signed in, and no member has ever opened a
+shell or a chat. So the window existed and nobody was standing in it.
+
+Worth writing down because the code cannot tell you this, and the next person to find a world-readable
+secret here will reach for the alarm before asking. **Ask who actually uses the install before deciding
+how bad an exposure is.**
+
+Should this ever need rotating on an install that IS used: clear `proxySecret`, then restart
+`officer-anthropic-proxy` **and** `officer-claude-code` together — the agent sidecar caches the value in
+`process.env.ANTHROPIC_API_KEY` and `ensureAnthropicEnv` returns early once it is set, so rotating the
+proxy alone 401s every turn until the agent is restarted too.
 
 ## The mechanism, and the trap in it