note: next session — fix allowlist.json ownership + no-sync policy

allowlist.json must be root-owned so POST /allowlist is the only write
path; direct file edit bypasses audit log and danger veto. No cross-
bridge sync — allowlists grow organically per server.

agent-builder/.claude/context.md

@@ -202,7 +202,12 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
 - 524 on destructive commands: Cloudflare kills long-poll at ~100s; approval must be tapped quickly; command still runs if approved before timeout, response just lost
 
 **NEXT SESSION — in order:**
-0. sudo-bridge-server01 — sync POST /allowlist endpoint
+0. sudo-bridge (both) — fix allowlist.json file ownership
+   - Problem: allowlist.json is administrator-owned on both servers — Claude can bypass POST /allowlist entirely with a direct file edit, defeating the audit log, NTFY notification, and danger-pattern veto
+   - Fix: chown root:root + chmod 644 allowlist.json on both primary and server-01 — daemon writes via root (systemd), Claude must use POST /allowlist endpoint
+   - After fix: verify POST /allowlist still works (daemon writes as root), verify direct Edit tool to allowlist.json is denied
+   - Sync policy decision: NO cross-bridge sync — allowlists grow organically per server (primary ≠ server-01 purposes); when a command is needed on server-01 it gets added there at that time
+0a. sudo-bridge-server01 — sync POST /allowlist endpoint
    - POST /allowlist was added to sudo-bridge (primary) this session but server-01 bridge container was NOT redeployed — it's still running the old image without the endpoint
    - Both bridges share gitea.local/backtalk6858/sudo-bridge:latest — code is already in the image, just need to redeploy server-01 bridge (Coolify UUID: o2kz1puml1mmneyiqd96mouj) via pull + restart
    - Also: server-01 allowlist.json needs the 4 new entries added today (iptables-save, 99-local-routing.conf, sysctl -p, journalctl -u) — these are primary-only entries so only add if relevant to server-01 use cases