chore(albok-service): deploy 0.1.13 on nh3-albok (unit 4.2 sensitivity gate; albok-dev ask 8413)

stacks/albok-service/README.md

@@ -8,7 +8,23 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
   (`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04.
 - **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390.
   Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed.
-- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.12` @ `sha256:a29a7e46…` since 2026-10-06 1254 (healthy 1254:48,
+- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.13` @ `sha256:bea95617…` since 2026-10-07 1135 (healthy 1136:17,
+  between walks). infra-ops deployed it at albok-dev's ask (althing 8413), from a clean archive of vh/albok `70b55ad7`
+  (tag albok-service/v0.1.13). Unit 4.2, the **sensitivity gate**: objects classed `adult` / `personal` / `secret` are
+  hidden from every reader unless the token asks to `include` them AND holds `class:<building>/<wing>/<class>` (a wing
+  write grant implies its classes). A rule-based detector marks credential-bearing objects `secret`. No config, key or
+  token change. `/health` gains `leaks` (a count; null degrades status) and `hidden_map_stale`; `GET /health/leaks`
+  (admin token) lists the ids. The first start scans every wing once (fleet/memory 11,355 objects in 12 s) and writes
+  `<private_root>/wings/*/SCANNED`. **2026-10-07 census: `leaks` 8.** Six objects hold the shared all-agents LiteLLM
+  key, which is distributed on purpose, so nothing needed rotating. Two (shutterchute archival-memory) are false
+  positives on a `http://user:…@gw` doc placeholder. Reported to albok-dev.
+  ⚠ **Rollback is NOT free.** 0.1.12 cannot load a sidecar that has a `sensitivity` section, and the scan writes that
+  section and commits it per wing (fleet/memory `0032841`, personal/agent-feedback `4b7883a`; HEADs before the start
+  were `02012e4a` / `2342899e`). To roll back: stop the service, run the strip snippet in vh/albok
+  `packages/albok-service/README.md` ("Rolling back to 0.1.12") from `/srv/albok/store`, then start
+  `compose.yaml.pre-0.1.13`. The strip re-exposes every hidden object to every reader. To roll forward again, delete
+  every `/srv/albok/private/wings/*/SCANNED` first. Nemi must match the service: 0.1.4 with 0.1.13, 0.1.3 with 0.1.12.
+  Prior: 0.1.12 @ `sha256:a29a7e46…` (2026-10-06 1254 – 2026-10-07 1135) (healthy 1254:48,
   between walks; the Nemi timer now fires at :03). infra-ops deployed it at albok-dev's ask (althing 8199), from a clean archive
   of vh/albok `751a729` (tag albok-service/v0.1.12). It is the heid bug-hunt fold over unit 4.1 (contract rev 1.10). No route,
   config or schema change. Rollback: `compose.yaml.pre-0.1.12` (0.1.11) stays free even after a reindex, because 0.1.11 and

stacks/albok-service/compose.yaml

@@ -15,7 +15,7 @@
 #   1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
 services:
   albok-service:
-    image: gitea.phasefinal.com/pfi/albok-service:0.1.12@sha256:a29a7e462f1823e6c775b8c9f8b54a401b182693fe915176917af933e04e1aa5
+    image: gitea.phasefinal.com/pfi/albok-service:0.1.13@sha256:bea9561710c3d69ba27aadb6e16c6d8f9daee5d92146b580fb1eb272bf1ddd64
     container_name: albok-service
     restart: unless-stopped
     ports: