docs(audit): Tim's machine IOC resolved — export was user-initiated

FORK-AUDIT.md

@@ -254,7 +254,19 @@ primary evidence source for them.
 
 ---
 
-## Part 5: Open discussion points
+## Part 4c: Tim's machine (tim-neuron-mac) — RESOLVED 2026-08-21
+
+- opencode desktop remnants removed; CLI/credentials never present.
+- **claude.ai data export (Aug 19): RESOLVED — Tim performed it himself.**
+  Not an exfiltration IOC.
+- VS Code + Claude SDK cache removed with forensic archive preserved at
+  `~/neuron-ir-evidence/vscode-20260821-1740.tar.gz`.
+- Still open on that device: Ollama bound to `*:11434` (all interfaces);
+  internal build-name crash reports in `~/Library/CrashReporter`.
+
+---
+
+
 
 1. The workspace/sync runtime (`control-plane/workspace.ts`, ~966 lines) still
    contains console-sync client code that is inert without Anomaly's infra.

packages/opencode/bin/neuron

@@ -18,6 +18,12 @@ case "$ARCH" in
   *) TARGET="" ;;
 esac
 if [ -n "$TARGET" ] && [ -x "$PKG/dist/$TARGET/bin/opencode" ]; then
-  exec "$PKG/dist/$TARGET/bin/opencode" "$@"
+  BIN="$PKG/dist/$TARGET/bin/opencode"
+  # launch-integrity record: every run logs WHO ran and WHAT its fingerprint was
+  LOG_DIR="${XDG_STATE_HOME:-$HOME/.local/state}"
+  SUM=$(shasum -a 256 "$BIN" | cut -d" " -f1)
+  mkdir -p "$LOG_DIR"
+  echo "{\"t\":\"$(date -u +%FT%TZ)\",\"event\":\"launch\",\"bin\":\"$TARGET\",\"sha256\":\"$SUM\"}" >> "$LOG_DIR/neuron-guard.jsonl"
+  exec "$BIN" "$@"
 fi
 exec bun run --conditions=browser "$PKG/src/index.ts" "$@"

packages/opencode/bin/neuron-verify

@@ -0,0 +1,59 @@
+#!/bin/sh
+# neuron-verify: one-command integrity audit for the Neuron install.
+# Run any time; run especially after OS updates, brew operations, or anything
+# that touches PATH.
+
+FAIL=0
+
+echo "== 1. Command resolution =="
+for cmd in neuron opencode; do
+  echo "-- $cmd:"
+  type -a "$cmd" 2>/dev/null || echo "   (not found)"
+done
+echo "   [expect: neuron -> ~/.bun/bin or /opt/homebrew/bin -> repo launcher]"
+echo "   [expect: opencode -> NOT FOUND]"
+
+echo ""
+echo "== 2. Launcher symlink chain =="
+for link in /Users/will/.bun/bin/neuron /opt/homebrew/bin/neuron; do
+  if [ -L "$link" ]; then
+    target=$(readlink "$link")
+    case "$target" in
+      */opencode/bin/neuron) echo "OK  $link -> $target" ;;
+      *) echo "BAD $link -> $target (points at wrong script)"; FAIL=1 ;;
+    esac
+  else
+    echo "MISSING $link"; FAIL=1
+  fi
+done
+
+echo ""
+echo "== 3. Binary fingerprint (compare against last build) =="
+BIN="/Users/will/Development/neuron-technologies/opencode/packages/opencode/dist/opencode-darwin-arm64/bin/opencode"
+if [ -x "$BIN" ]; then
+  shasum -a 256 "$BIN"
+else
+  echo "no dist binary (launcher will use source mode)"; FAIL=1
+fi
+
+echo ""
+echo "== 4. Launch history — look for sha256 values you don't recognize =="
+LOG="${XDG_STATE_HOME:-$HOME/.local/state}/neuron-guard.jsonl"
+if [ -f "$LOG" ]; then
+  grep '"event":"launch"' "$LOG" | tail -10
+else
+  echo "no launch log yet"
+fi
+
+echo ""
+echo "== 5. Vendor egress check =="
+grep -c "opencode.ai\|anomalyco" "$LOG" 2>/dev/null | { read n; echo "$n vendor egress entries in guard log"; }
+grep '"blocked":true' "$LOG" 2>/dev/null | tail -3
+
+echo ""
+echo "== 6. Upstream binaries on this machine =="
+find /opt/homebrew/Cellar ~/Library -maxdepth 3 -iname "*opencode*" 2>/dev/null | head -5
+ls ~/.bun/install/global/node_modules 2>/dev/null | grep -i opencode | head -3
+echo "[empty is good]"
+
+exit $FAIL