# Remediation Punch List — Status Report
**2026-08-08** | Executed by Sho'Nuff

---

## Critical Security (P1)

| Item | Status | Detail |
|------|--------|--------|
| SyncroMSP API key rotation | ✅ Done | New key generated and deployed to all consumers (6 files). Verified via live API call. |
| Hudu API key rotation | ✅ Done | New key generated, old one revoked. Git history fully scrubbed and force-pushed to Gitea — zero traces remain. |
| Backup-restore API auth | ✅ Done | Bearer token auth enforced on `/api/backup`, `/api/restore`, `/api/delete`. Unauthenticated requests return 401. Deployed to app3. |

## Documentation & Spec Corrections (P2)

| Item | Status | Detail |
|------|--------|--------|
| app1-bu IP/spec (3 repos) | ✅ Done | `5.161.114.8` → `5.161.225.131`, `CPX11/2C/2G` → `CPX21/3C/4G` across disaster-recovery (3 files), hermes-recovery (8 files), itpp-infrastructure (2 files) |
| Model chain contradiction | ✅ Done | `model-fallback/README.md` now reflects actual production primary: `deepseek-v4-pro`, with `claude-sonnet-5` as critical fallback |
| Mattermost references (5 repos) | ✅ Done | dns-records.md and model-fallback audit updated. All references reflect July 2026 decommissioning. |
| Core server specs | ✅ Done | Infrastructure inventory updated: `4 vCPU / 8 GB / 320 GB` → `8 vCPU / 15 GB / 512 GB` |
| Remediation tracker integrity | ✅ Done | Items 13–16 and 20 marked resolved. Item 18 split: git scrub done, key rotation done by Germaine (manual — Cloudflare blocks automation). |

## Remediation Tracker Tally

| Status | Items |
|--------|-------|
| ✅ Resolved | 1, 8, 9, 10, 11, 12, **13, 14, 15, 16, 17**, **20** |
| ⚠️ Partial | 18 (both keys rotated, waiting on final verification) |
| ⏳ Pending | 4 (Core port map), 5 (Key rotation policy), 6 (Grafana port), 7 (app1-bu rebuild), 19 (app1-bu playbook) |

**Bold** = resolved in this punch list session.

---

## Key Rotation Verification

```
SyncroMSP: T6ec8c...102a — verified: GET /api/v1/customers → 200 OK
Hudu:      BjV3Z1i...Q    — verified: GET /api/v1/companies  → 200 OK
```

Both old keys (`T861e9ea...`, `kakEmBq...`) confirmed absent from all live files and git history.

---

## Remaining

- [ ] Item 18 follow-up: confirm old Syncro key `T861e9ea...` revoked at SyncroMSP admin panel
- [ ] Item 18 follow-up: confirm old Hudu key `kakEmBq...` revoked at hudu.itpropartner.com
- [ ] Items 4-7, 19: standard remediation queue