[Security][CLI] Connector key file follow-ups from PR #2665: remediate pre-existing files, guard API/CLI helper parity, document the non-ACL filesystem fail-closed

[Chris0Jeky]

Follow-ups from the fresh-context review of PR #2665 (closes #1262), none of which block that PR: the PR fixes the write-before-chmod TOCTOU and gives NEW connector-key files an owner-only DACL on Windows and an exact 0600 on Unix, by a faithful copy of the API's FirstRunBootstrapper.WriteRestrictedFile (PR #1267). Three MEDIUM and one LOW finding stay open here.

1. Forward remediation of key files created before PR #2665 (MEDIUM)

CliFirstRunBootstrapper.EnsureKeyOnDisk returns as soon as ReadExisting finds a key, so PersistKey never runs against an existing appsettings.local.json. A Windows user who ran the CLI before this fix keeps a key file with the directory's inherited DACL (typically BUILTIN\Users read) forever. The API shipped an explicit remediation path for exactly this (FirstRunBootstrapper.RestrictFileToCurrentUser / RestrictExistingLocalConfigFile, #1241); the CLI has none.

Ask: on the existing-key path, restrict the existing file to the current user (owner-only protected DACL on Windows, 0600 on Unix), best-effort with a stderr warning on failure, never a fatal error; mirror the API's helper and its test (RestrictFileToCurrentUser_LocksFileToCurrentUserOnly).

2. Drift guard between the API and CLI copies of the helper (MEDIUM)

backend/src/Taskdeck.Cli/RestrictedFileWriter.cs says "keep the two in sync" but nothing enforces it; the CLI structural test pins four substrings in the CLI copy only. A future hardening of the API helper (for example an ACE-count assertion) would leave the CLI copy silently weaker.

Ask: a structural parity test that reads both sources, strips comments and blank lines, and asserts the shared method bodies (WriteRestrictedFile both overloads, CreateRestrictedNewFile, CreateOwnerOnlyFileWindows, BuildOwnerOnlyFileSecurity) are identical, so any divergence is a red on the side that changed. The PR's own parity check was done by hand (verification item 8 in the PR body).

3. Document the new fail-closed behaviour on non-ACL filesystems (MEDIUM)

The CLI resolves its key file next to the data directory (TASKDECK_CONNECTION_STRING), a user-chosen location that can be a FAT32/exFAT drive or an SMB share without security-descriptor support. There, CreateOwnerOnlyFileWindows now refuses (the read-back DACL is unprotected), PersistKey throws IOException, and EnsureKeyOnDisk warns and falls back to a per-run transient key, which means connector secrets encrypted in one run cannot be read in the next. This is the same posture the API takes for its own config file and the thrown message names FAT32/exFAT, but no operator doc records it.

Ask: one paragraph in docs/platform/CONFIGURATION_REFERENCE.md (and the Windows quick start if it mentions the data directory) saying the data directory must live on a filesystem that can store owner-only permissions, what happens otherwise, and how to move it.

4. Reconcile the accepted-risk record (LOW)

docs/COURSE_CORRECTION.md section 3 lists #1262 (with #1242 and #1261) as an explicit accepted-risk write-off under the single-user threat model, while docs/analysis/2026-08-23-realignment/open-issues.tsv re-lists #1262 as pending Priority II security work. PR #2665 follows the later record. Ask: a dated note on the COURSE_CORRECTION entry saying #1262 shipped in PR #2665 and whether #1242 and #1261 remain written off (maintainer wording; the beta lane does not decide the threat-model boundary).

Refs #1262, PR #2665, #1241, #1264, PR #1267.

[Chris0Jeky]

[Claude lane claim v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2667, items 1 to 3 only (item 4, the COURSE_CORRECTION reconciliation, is maintainer wording and stays open)
scope: backend/src/Taskdeck.Cli/CliFirstRunBootstrapper.cs existing-key path (forward remediation: restrict an existing key file to the current user, best-effort, warning on failure, never fatal), backend/src/Taskdeck.Cli/RestrictedFileWriter.cs (the API's RestrictFileToCurrentUser copied alongside the writer), backend/tests/Taskdeck.Cli.Tests (remediation tests plus a structural parity test that diffs the shared method bodies of the API and CLI helpers with comments and blank lines stripped), and one paragraph in docs/platform/CONFIGURATION_REFERENCE.md on the data directory needing a filesystem that stores owner-only permissions. No API source change.
branch: issue-2667/cli-key-remediation-parity (worktree codex-2667-cli-key-remediation-parity)
proving checks: dotnet test backend/tests/Taskdeck.Cli.Tests -c Release -m:1, dotnet test backend/tests/Taskdeck.Api.Tests -c Release -m:1 --filter "FullyQualifiedName~FirstRunBootstrapperTests" (the parity test reads the API source), Architecture.Tests, solution build, docs governance.
merge disposition: backend plus a platform doc, T3 gate (one fresh-context review, exact-head ci-required, three-minute aging).

[Chris0Jeky]

[Claude lane release v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2667 (items 1 to 3 shipped; item 4 stays open for maintainer wording)
PR: #2671
exact head: cf359fb (content head afbd16b plus update-branch against main)
merge commit: d12ff8d
result: merged
shipped outcome: (1) forward remediation: on every run where the CLI resolves its own key file, EnsureKeyOnDisk restricts an existing appsettings.local.json to the current user before returning the key (owner-only protected DACL on Windows, exactly 0600 on Unix) through RestrictedFileWriter.RestrictFileToCurrentUser, a verbatim copy of the API's #1241 helper; it never reads, rewrites or deletes the file, and a failure becomes one stderr warning naming the path (stdout stays clean JSON); the unreadable-file (PreserveFile) branch gets the same call. Red first: a key file written the old way stayed world-readable on the pre-fix source; after the fix the persisted key is unchanged byte for byte and owner-only. (2) parity guard: a [Theory] reads both FirstRunBootstrapper.cs and RestrictedFileWriter.cs, strips comments and blank lines, normalizes line endings, and asserts the six shared method bodies are identical, naming the method and the first differing line; it fails, not skips, when a source is missing, and a one-character mutation turned exactly one row red. (3) docs/platform/CONFIGURATION_REFERENCE.md states the data directory must sit on a filesystem that stores owner-only permissions, what happens on FAT32/exFAT/SMB for a new key (refusal, warning, per-run transient key) and for an existing key (kept, warning where the filesystem reports the failure, none where it silently ignores permission changes), that the lockdown is not re-applied when Connectors__EncryptionKey is configured, and the remedy. The exception-surface inventory row for the bootstrapper was refreshed with exhaustive catch offsets and the new stderr site classified. Two fresh-context review rounds, both SHIP; every MEDIUM and LOW fixed (tests and docs) or declined with reasoning on the PR. Verification: Cli.Tests 241/241, Architecture.Tests 28/28, solution build 0 errors, full serialized backend solution 0 failed at the content head; docs governance and the unknown-exception boundary guard green; exact-head ci-required green at cf359fb after one rerun of two tracked launcher-suite reds (#2561 on Windows, #2588 on Linux; both recorded).
remaining residual: item 4 (the docs/COURSE_CORRECTION.md accepted-risk record for #1262/#1242/#1261) is maintainer wording and stays open on this issue. Declined LOWs: the parity guard compares parity, not the lockdown contract (a symmetric weakening passes; the behavioural DACL and mode tests pin the contract); bootstrap-lock-unavailable plus an unreadable file returns a transient key before remediation; File.SetUnixFileMode follows a symlink at the key path (needs write access to the CLI's own data directory). The Unix branch executed only on the Ubuntu CI leg; the PreserveFile branch is pinned structurally on Linux and behaviourally on Windows.
released paths/leases: backend/src/Taskdeck.Cli/CliFirstRunBootstrapper.cs; backend/src/Taskdeck.Cli/RestrictedFileWriter.cs; backend/tests/Taskdeck.Cli.Tests/**; docs/platform/CONFIGURATION_REFERENCE.md; docs/security/UNKNOWN_EXCEPTION_SURFACE_INVENTORY.md
next dependency now unblocked: none.

[Chris0Jeky]

Coordinator note (2026-09-05, Project state): Now to Blocked after PR #2671 (merge d12ff8d) landed items 1 to 3. The only remaining item is 4, the non-ACL filesystem wording, which the beta lane recorded as maintainer-gated; it waits with the rest of the maintainer queue in OUTSTANDING_TASKS.md.