docs(audit): Tim's machine IOC resolved — export was user-initiated

2026-08-21 17:43:16 -05:00
parent 9d323bbb07
commit cc9afb50c7
3 changed files with 79 additions and 2 deletions
@@ -254,7 +254,19 @@ primary evidence source for them.

 ---

-## Part 5: Open discussion points
+## Part 4c: Tim's machine (tim-neuron-mac) — RESOLVED 2026-08-21
+
+- opencode desktop remnants removed; CLI/credentials never present.
+- **claude.ai data export (Aug 19): RESOLVED — Tim performed it himself.**
+  Not an exfiltration IOC.
+- VS Code + Claude SDK cache removed with forensic archive preserved at
+  `~/neuron-ir-evidence/vscode-20260821-1740.tar.gz`.
+- Still open on that device: Ollama bound to `*:11434` (all interfaces);
+  internal build-name crash reports in `~/Library/CrashReporter`.
+
+---
+
+

 1. The workspace/sync runtime (`control-plane/workspace.ts`, ~966 lines) still
   contains console-sync client code that is inert without Anomaly's infra.