Ticket graphs

SECURITY-AUDIT FOLLOW-UP + a telemetry gap, found 2026-07-23 while confirming the notesdb->cnotes rename (tombstone in config/config.json .retired[com.claude.notesdbd.plist]). FINDING 1 (audit red flag): the RETIRED launchd plist ~/Library/LaunchAgents/com.claude.notesdbd.plist carries a `uchg` USER immutable flag (confirmed via `ls -lO`; it is uchg, NOT schg, so no sudo). An immutable flag on a LaunchAgent is a classic persistence pattern, which is what tripped the audit. It is BENIGN here -- a known, tombstoned retirement superseded by com.claude.cnotesd -- and the retired label is NOT loaded (launchctl shows only com.claude.cnotesd, PID 730). No unload needed. REMEDIATION (human-gated; a security-setting change, owner should run it to keep the audit chain clean): `chflags nouchg <plist>` then `rm <plist>`. Do NOT edit/reload -- it is superseded. No sudo. FINDING 2 (dead wrapper): notes_db_mcp is the containerized MCP adapter whose launchd plist runs `docker compose -f jazz-new/docker-compose.yml` from /Users/steve/code (pre-rename stale path, no compose file). It is NOT the store. Deregister/remove it so it stops reading as a real service. FINDING 3 (telemetry gap): cnotesd (the live notes+telemetry store, ~/.claude_tools/notes.db, :8002) has a `telemetry` table and a POST /telemetry endpoint but 0 telemetry rows -- nothing writes to it. This is the LOCAL telemetry home referenced by the peer_system "telemetry stays local" decision. DECIDE: wire peer_system (and other tools) to POST /telemetry, or confirm it is intentionally empty. Reference memory: notesdb-renamed-cnotesd. Filed as a reminder to return to this.

— browse congruency source (forge-parked tree)