# Security & license deployment — Albert Lane Covered Works **Do this first** when adding folders, unpacking archives, creating packages, or staging GitHub/Cloudflare work under `/workspace`. ## 1. License pack (required on every new root) Copy from `/workspace`: | File | Purpose | |------|---------| | `LICENSE.md` | Albert Lane Proprietary Software License and IP declaration | | `LICENSE-SCOPE.md` | Applies to this computer, VMs, and hypervisors | | `AGENTS.md` | Assistant / workflow instructions (this process) | Contractual (Part B) use requires an **in-person agreement with verbal and written authorization** from Albert Lane. Do not substitute MIT, Apache-2.0, CC-BY, or other browse-wrap FOSS licenses for Covered Works. The only controlling license is `/workspace/LICENSE.md` (Albert Lane proprietary; sha256 prefix `f5db5cbf7f0df4f5`). Copies on other roots must stay byte-identical to that file. Do not treat Apache-2.0 SPDX headers, Google AI Studio license banners, or Anthropic/Claude co-author notices inside exports as Albert Lane license revisions or editions. Those companies inserted those headers themselves. They do not replace `LICENSE.md`. Do not delete Article V or Article XVI. Article V is Albert Lane's own illustration. ## 2. Security deployment (filesystem) 1. **No real secrets on this machine** — treat `/workspace` as disposable; master keys and live tokens stay on the Rights Holder’s owned devices (e.g. Pixel / Termux). Demo vault material is not production. 2. **No secrets in GitHub** for Worker-backed pipelines — bind secrets in Cloudflare (e.g. `WEBHOOK_LEDGER_SECRET` via `wrangler secret put`); verify HMAC (`X-Hub-Signature-256`); never interpolate secrets into logs or command lines. 3. **Minimum GitHub App scopes** — prefer read-only contents; write only what the pipeline needs (e.g. deployments/statuses for `news-albertlane-org-dispatch`); never administration, org admin, or repository secrets permission unless Albert Lane explicitly authorizes. 4. **SSL required** on webhooks — no verification bypass. 5. **Inventory** — refresh `/workspace/MANIFEST.json` (+ `MANIFEST.md`) when adding roots or substantial packages. 6. **FROI naming** — First Report of Injury / Freedom Requests Of Information; do not shorten labels to “Fro.” 7. **Archives** — after unpacking a zip/tar into a new project directory, run this deploy (license pack + AGENTS) before further edits. ## 3. Canonical roots that must stay licensed - `/workspace` - `/workspace/docs` - `/workspace/docs/github-ops` - `/workspace/docs/albertlane-net` - `/workspace/docs/grok-bot-runtime` - `/workspace/docs/ai-topology` - `/workspace/docs/fraud-packet-katu` - `/workspace/docs/sec-tcr-17684` — SEC Form TCR packet and supporting forensic materials for reference 17684-273-411-436 - `/workspace/repo` - `/workspace/lane_pyvisor` - `/workspace/local-secret-ledger` - `/workspace/lane-bot-android` - `/workspace/lane-terminal-android` - `/workspace/lane-froi-vault-android` - `/workspace/lane-froi-engine` — Lane FROI Engine AI Studio Android/Python export (package left `com.example`; planned `org.albertlane.froiengine` not applied; no live Gemini key; no invented app code) - `/workspace/storage-redundancy` - `/workspace/albertlane-net` - `/workspace/tauri-rustxml` - `/workspace/lane-sovereign-mesh` — xAI Sovereign Mesh Vite/React/TS dashboard with nested JS/Rust/Julia tree - `/workspace/lane-sec-register` — Forensic Viewer v2 SEC register Vite Covered Work - `/workspace/lane-gemini-ultra-shell` — Rust/Tauri Gemini Ultra Shell Covered Work (no real Gemini API keys) - `/workspace/gemini-ultra-vault` — Gemini Ultra Vault AI Studio workstation (AUTONOMOUS_API_KEY redacted to PLACEHOLDER_NOT_STORED; export license.md, LICENSE_Live.md, and legal.md are not controlling) - `/workspace/lane-gemini-voice-lab` — Gemini Voice Lab AI Studio React/Vite Covered Work (upstream SPDX header kept in source; no live Gemini API key) - `/workspace/lane-forensic-canary` — Albert Lane Forensic Canary AI Studio export (empty shell; no invented app code) - `/workspace/private-edge` — Docker image build context for `albertlane/private-edge` (historical-record redundancy carrier; not a secret store) - `/workspace/pystudio` — mislabeled copy of Silicon Whisperer OS version 2 (metadata name). Left in place until Albert Lane says to remove it. Not the metadata name. No live Gemini key. Google AI Studio banner and export MIT or Apache license banners are not controlling. - `/workspace/silicon-whisperer-os-r1` — Silicon Whisperer OS version 1 (metadata name). Historical unpack only. Not overwritten. Zip SHA-256 `53a63274fe900ad55f50743eb922f56bddfc19f986485ccc9ac3634da9f429c5`. - `/workspace/silicon-whisperer-os-r2` — Silicon Whisperer OS version 2 (metadata name). Own copy of the bytes that were filed under the wrong name at `/workspace/pystudio`. Version 1 is `/workspace/silicon-whisperer-os-r1`. Zip SHA-256 `c82f971e1bd4934891734fdb8f5e5fec45d769a8ceee55ac808c5703be5c0f9f`. No live Gemini key. Google AI Studio banner and export MIT or Apache license banners are not controlling. - `/workspace/truth-archive` — Truth Archive (metadata name). Sovereign local investigation browser. 19 regular files before ownership artifacts. Zip 13 files / 15 members. No `.env.local`. No private key. Google AI Studio banner is not controlling. - `/workspace/silicon-whisperer-os-remix` — Remix: Silicon Whisperer OS (metadata name). New version. `/workspace/silicon-whisperer-os-r1` and `/workspace/silicon-whisperer-os-r2` were not overwritten. Zip SHA-256 `8fe0f943845d94029213cdf6d1bfc657dc9bacca3237aa6ba687d678455e4365`. 19 archive files / 23 members. No live secret. `.env.example` MY_ placeholders kept. Google AI Studio banner is not controlling. - `/workspace/docs/lane-vm` — LANE-VM architectural determinism paper (Covered Work; canonical license text is `/workspace/LICENSE.md`) - Any new project root created under `/workspace` ## 4. Quick check ```bash for d in /workspace /workspace/docs /workspace/docs/github-ops /workspace/docs/albertlane-net \ /workspace/docs/grok-bot-runtime /workspace/docs/ai-topology /workspace/docs/fraud-packet-katu \ /workspace/docs/sec-tcr-17684 /workspace/lane-sec-register \ /workspace/repo /workspace/lane_pyvisor /workspace/local-secret-ledger \ /workspace/lane-bot-android /workspace/lane-terminal-android /workspace/lane-froi-vault-android \ /workspace/storage-redundancy /workspace/albertlane-net /workspace/tauri-rustxml \ /workspace/lane-sovereign-mesh /workspace/lane-gemini-ultra-shell \ /workspace/gemini-ultra-vault \ /workspace/lane-gemini-voice-lab /workspace/lane-forensic-canary \ /workspace/lane-froi-engine \ /workspace/private-edge /workspace/docs/lane-vm \ /workspace/pystudio /workspace/silicon-whisperer-os-r1 \ /workspace/silicon-whisperer-os-r2 /workspace/truth-archive \ /workspace/silicon-whisperer-os-remix; do test -f "$d/LICENSE.md" && test -f "$d/LICENSE-SCOPE.md" && test -f "$d/AGENTS.md" \ && test -f "$d/SECURITY-DEPLOY.md" && echo "OK $d" || echo "MISSING $d" done ``` Rights Holder: Albert Lane. See `LICENSE.md`. ## 5. Ownership attestation (DEMO box key) Cryptographic ownership proofs for Covered Works live under `/workspace/.lane/ownership/` and are documented in `/workspace/OWNERSHIP-CRYPTO.md`. - Generate/sign with: `./scripts/attest-ownership.sh` - The box key is **DEMO ONLY** (`demo-box-attestation.pem`). Albert Lane must re-sign with a Pixel / owned-device key for court or agency strength. - Private `*.pem` keys are gitignored; never commit the demo private key as if it were production. ## 6. Forensic historical record (standing) Every repository or workspace root on this machine, and anything pushed to or obtained from GitHub, must keep a forensic historical timeline, forensic integrity, provenance, a manifest, license verification (Albert Lane proprietary pack present; controlling text is `LICENSE.md` only), and cryptographic proof (`OWNERSHIP-MANIFEST.sha256` + `OWNERSHIP-ATTESTATION.json` signed via `scripts/attest-ownership.sh`). Historical record redundancy: keep prior attestation events in `.lane/ownership/ledger.jsonl` (append-only). Do not delete prior ledger lines. Docker image `albertlane/private-edge` is a redundancy carrier for Covered Works historical records, not a secret store. No secrets in the image. Images must be rebuilt after an attestation refresh. Push happens only when Albert Lane is signed into Docker Hub. Do not `docker login` or `docker push` from this disposable box until that sign-in. The push command shape is `docker push albertlane/private-edge:tagname`. Telemetry inventory: `/workspace/telemetry.txt` (copy at `/workspace/docs/telemetry.txt` when `docs/` is a licensed root). That file is an inventory, not a claim that listed URLs are live. Its hash belongs in the ownership manifest. ## Upload filing (standing) Every file the user uploads is saved under the name inside the file (`metadata.json` name) or the name the user states for that upload. Each version gets its own directory. Never unpack a later file over an earlier tree. Every saved upload gets SHA-256 hashes and a demo-box Ed25519 ownership attestation via `/workspace/scripts/attest-ownership.sh`, then the workspace root is re-attested. The append-only ledger is `/workspace/.lane/ownership/ledger.jsonl`. Do not delete prior copies to "clean up." FROI means First Report of Injury and/or Freedom Requests Of Information.