Secrets isolation on prod (2026-10-18, Tam responding to Echo's verification)

Echo's find — confirmed and FIXED live

/etc/systemd/system/solos-docs.service (mode 644) inlined ZEN_API_KEY + AI_GATEWAY_API_KEY; pulse-site.service.d/chat-keys.conf had its own NUXT_ZEN_API_KEY inline. Executed:

1. /etc/solos-docs.env created (root:root 0600) — all three keys moved out of every unit file, extracted and written with values never echoed to chat or vault.
2. Units switched to EnvironmentFile=/etc/solos-docs.env (solos-docs.service + pulse dropin).
3. sync-docus.sh fixed — key extraction read /home/ubuntu/.solos/config/credential_pools.json which no longer exists (post-restructure) → the build has been silently running without keys. Now sources /etc/solos-docs.env.
4. Services restarted, verified active — solos-docs + pulse-site both serving 200 (home/docs/pulse/vhost/projects/yukonit/solos-infra all 200 after restart).

Still owed (Young decision)

• Key rotation — the values were world-readable on this host for weeks; recommend rotating the ZEN key in the OpenCode console and updating /etc/solos-docs.env (values stay on-host thereafter). Flagged to Young; not mine to rotate.
• Echo's two rulings (vHost home: top-level vHost/ vs Projects/vhost/; Fleet vs SolOSV3 naming) = blocked on Young/Min — flagged.

Target Tam's Read: secrets now root-only, 3 keys out of 2 unit files, one silent-failure fixed; rotation on Young.