# 🤖 SSH access ledger — the why-entries

One JSON file per entry — changelog-style, so parallel PRs never conflict.
These are the *human* half of the public SSH access ledger
(status.elevenmessenger.com/ssh.html): the box-side collector
(`deploy/ssh-ledger-collect.sh`) publishes the automatic truth (who connected,
when, from where) from sshd's journal; the files here say **why**. The
collector merges them into `ssh-entries.json` and the page joins entry to
session by operator + date/time-window overlap. Full picture:
`docs/status.md § The SSH access ledger`.

## The convention

**Any session — Claude or human — that SSHes to the router box adds an entry
file here, in the same PR as the work (or an adjacent one).** A session the
collector can't match to an entry renders loudly on the public page as
"no summary recorded" — that state is the enforcement, so don't let it be
yours. One entry may cover several sessions in the same working window.

File name: `YYYY-MM-DD-<slug>.json` (like a changelog entry's name), e.g.
`2026-07-14-wireguard-rollout.json`.

```json
{
  "date": "YYYY-MM-DD",
  "operator": "Full Name (as in web/status/ssh-operators.json)",
  "window": "HH:MM–HH:MM UTC (approx)",
  "why": "terse what-not-how summary",
  "refs": ["https://github.com/elevenmessenger/messenger/pull/NNN"]
}
```

- `date` + `window` are UTC and approximate — the page matches forgivingly
  (same operator, same date, nearest/overlapping window), so don't sweat
  minutes; do keep the date right.
- `operator` must match a handle in `web/status/ssh-operators.json`, or the
  join will miss.
- `refs` — PR/issue URLs or numbers the session's work landed in; may be empty.

## The redaction bar (mirrors the prompt registry's)

These entries are public forever. PR review is the redaction gate — reviewers
hold this line:

- **What, not how.** "Rotated the push relay's tokens" — never the procedure,
  the file paths where key material lives, or anything that maps the defences.
- **Never a credential, never an email**, never a secret's value or location.
- **Security-sensitive sessions don't vanish — they tombstone.** A session
  whose honest summary would itself weaken the box publishes as
  `"why": "(withheld: security)"` — the access stays on the public record,
  only the reason is withheld. Silence (no entry at all) is not an option:
  that renders as "no summary recorded", which reads as *unexplained* access,
  not *protected* access.