config: update READMEs and compose files for various services

2026/2026-09-12--enc-inventur-rewrite-hooks.md

@@ -0,0 +1,60 @@
+# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY)
+
+**Status:** report only — **no** admin-log / firefly / Taler push this stretch  
+**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only  
+**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`)  
+**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0%  
+**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt`
+
+## Priority table (tip)
+
+| Priority | Repo | Outcome |
+|----------|------|---------|
+| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). |
+| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). |
+| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. |
+| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. |
+| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. |
+| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. |
+
+## Wrong origin (cleared)
+
+Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`.
+
+## Hooks (TODO320) — reinstall + smoke 2026-09-12
+
+Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`  
+Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh`
+
+```
+OK gitleaks=8.21.2 repos_linked=32
+podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
+ALL SMOKES PASSED
+  (a) secret push denied
+  (b) enc ciphertext allowed
+  (c) enc plaintext denied
+```
+
+`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks.  
+Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING).
+
+**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext).  
+Inventur STATUS close block appended same turn.
+
+## GPG recipients (credit + control)
+
+- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep)
+- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa)
+
+## Blocked / needs next Freigabe
+
+1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks.  
+2. Optional: commit/push work-output dirty overlay (2090) after review.  
+3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy.  
+4. Admin-log **push** of this file (report-only until Freigabe).
+
+## HALT (unchanged)
+
+- No ladder restart `@START_N=333`  
+- No admin-log / firefly / Taler push without Freigabe  
+- No force-push to `hernani/git.git`