docs: NEXT-SESSION addendum 8 — keys out of missions, judge resilience, the GLM burn, what is open

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/NEXT-SESSION.md

@@ -620,3 +620,38 @@ exit code came from grep, so two failures passed into a `&&` chain that
 committed and pushed. Nothing bad shipped — the failures were `PoolTimedOut`
 from Docker Desktop being down locally, and CI on a real Postgres was green —
 but the gate did not gate. Use `set -o pipefail`, or run cargo bare.
+
+## Addendum 8 — 2026-09-23, keys out of missions, judge resilience, the GLM burn
+
+**Shipped and proven on prod**
+- **LLM proxy** (`llm_proxy.rs`, `CLAWMATES_LLM_PROXY=1`): container-tier missions hold a
+  per-mission `cmlp.` token, not provider keys; `ANTHROPIC_BASE_URL` → server `:8089`
+  (unpublished). **MicroVM relay**: node daemon 0.5.0 pipes the guest's `127.0.0.1:11434` to the
+  proxy on gw-04's tailnet-only `100.102.112.85:8089`. Proven: container mission 01a0cf7e, microVM
+  claude 01a0cfc1, microVM kimi 01a0cfd5. Rollback: `CLAWMATES_LLM_PROXY=0` + recreate server.
+- **Delivery secret guard** (`delivery_secrets.rs`): pushes containing a server credential are
+  refused; events, verdicts and judge inputs are redacted. Canary `CLAWMATES_DELIVERY_CANARY`.
+- **Judge**: Kimi fallback (judge-eval 44/45), quota watchdog (`/api/judge/quota`, switch at 95%),
+  offline `npm ci` for JS projects.
+- **Templates**: `self_audit` recipe (continuous_improvement evidenced), frontend evidenced —
+  8 of 12. Frontend target repo `osobh/clawmates-frontend-scratch`.
+- **Taint** stages 1–2 (shadow). README rewritten against the repo.
+
+**The GLM quota burn** — the judge is ~0.1% of it. The 24/7 caller was SmartClaw's
+`smartclaw-reply-triage` on gw-02 (every 5 min on glm-5 against an inbox that has never had a
+row); moved to `ornith-fleet:9b` on **architect** every 15 min. SmartClaw's nightly Lead Discovery
+jobs (the 03:00 UTC spike) are still on glm-5. `zai-watch` timers fire 2026-09-25 01:55 UTC on six
+hosts (`/var/log/zai-watch.log`) to catch anything else after the reset.
+
+**Open, in rough priority**
+1. Rotate the z.ai and Kimi keys (operator creates them). Consumers: gw-04 `.env` (+ ~19 root-only
+   `.env` backups that hold the live key), Infisical, tank `glm` wrapper, quantum-trader, SmartClaw
+   gateway + MindHealth containers on gw-02. Give ClawMates its own key.
+2. After the reset: read `zai-watch` logs; run a GLM-backed microVM mission through the relay.
+3. Missions implemented on Kimi or GLM cannot be judged while GLM is down — the fallback is Kimi and
+   the Claude subscription judge is never tried from the independent branch.
+4. Enforcement decisions: task permission, `untrusted-target` (both shadow).
+5. Ollama on tank and architect listens on the tailnet with no auth (architect now serves SmartClaw).
+6. Remaining templates: mobile, gpu, threejs, insight_research.
+7. `ci/check-loc.sh` not in CI (12 files over 1500 lines); `hard_purge` vs usage ledger; the stray
+   draft mission `…25dff647`.