docs: update STATUS.md and JOURNAL.md with session progress

- STATUS.md: ISO rebuild in progress, updated next actions
- JOURNAL.md: Added session 2 entry for FIM/audit/SSH work, ADRs 005-007

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

JOURNAL.md

@@ -6,7 +6,146 @@
 
 ---
 
-## Entry 2026-02-17: Project Assessment and Test Coverage Analysis
+## Entry 2026-02-17 (Session 2): FIM, Audit, SSH Security Enhancements
+
+### Context
+Continued session focused on closing compliance gaps for CIS, FedRAMP, and CMMC.
+Added File Integrity Monitoring (FIM), comprehensive audit logging, and SSH client-only
+configuration. Resolved all shellcheck warnings and added git safety documentation.
+
+### Changes Implemented
+
+1. **File Integrity Monitoring (AIDE)**
+   - Added `config/hooks/live/aide-setup.sh`
+   - Configured to monitor /etc, /bin, /sbin, /usr/bin, /usr/sbin, /lib
+   - Initializes database on first boot
+   - Compliance: CIS 1.4, FedRAMP AU-7, CMMC AU.3.059
+
+2. **Comprehensive Audit Logging**
+   - Added `config/hooks/live/audit-logging.sh`
+   - Monitors: auth, access, modification, privilege, session events
+   - Log retention: 90 days
+   - Compliance: CIS 6.2, FedRAMP AU-2, CMMC AU.2.042
+
+3. **SSH Client-Only Configuration**
+   - Modified `config/hooks/live/ssh-client-only.sh`
+   - Disabled sshd service, removed server package
+   - SSH client tools remain for outbound connections
+   - Compliance: CIS 5.2, NIST 800-53 IA-5, CMMC IA.2.078
+
+4. **Shellcheck Fixes**
+   - Resolved all warnings in shell scripts
+   - SC2120/SC2119: Functions called without arguments (correct behavior)
+   - SC1091: Source files exist at runtime
+   - SC2034: Variables used in templates
+   - Result: ZERO shellcheck warnings
+
+5. **Git Safety Rules**
+   - Added to AGENTS.md:
+     - Quote all path arguments (handles spaces)
+     - Use non-interactive rebase (`git rebase --no-interactive` not available, use `-i` with care)
+     - Destructive operations require user confirmation
+
+### Test Coverage Update
+
+```
+Before Session: 31 tests
+After Session:  111 tests (+80)
+
+Unit Tests:        12 → 12 (unchanged)
+Integration Tests:  6 →  6 (unchanged)
+Security Tests:    13 → 44 (+31)
+System Tests:       0 → 47 (+47, new category)
+```
+
+### Architectural Decision Records
+
+#### ADR-005: File Integrity Monitoring via AIDE
+**Date**: 2026-02-17
+**Status**: Accepted
+
+**Context**: Need file integrity monitoring for compliance (CIS 1.4, FedRAMP AU-7).
+
+**Decision**: Use AIDE (Advanced Intrusion Detection Environment) with focused monitoring
+of critical system directories.
+
+**Rationale**:
+- AIDE is mature, well-supported on Debian
+- Lightweight compared to commercial alternatives
+- Meets multiple compliance requirements
+- Database can be rebuilt if needed
+
+**Consequences**:
+- Initial database creation on first boot (minor delay)
+- Regular checks recommended via cron
+- False positives if system packages updated legitimately
+
+#### ADR-006: Comprehensive Audit via auditd
+**Date**: 2026-02-17
+**Status**: Accepted
+
+**Context**: Need comprehensive audit logging for CIS 6.2, FedRAMP AU-2.
+
+**Decision**: Use auditd with rules for all major event categories.
+
+**Rationale**:
+- auditd is the Linux standard for audit logging
+- Kernel-level monitoring (cannot be bypassed by userspace)
+- Structured logs for analysis
+- Meets multiple compliance requirements
+
+**Consequences**:
+- Increased log volume (manageable with rotation)
+- Performance impact minimal on workstation workloads
+- Log retention policy required (90 days set)
+
+#### ADR-007: SSH Client-Only Mode
+**Date**: 2026-02-17
+**Status**: Accepted
+
+**Context**: KNEL-Football should have no inbound services.
+
+**Decision**: Remove SSH server, keep only client tools.
+
+**Rationale**:
+- Reduces attack surface significantly
+- Aligns with "outbound only" security model
+- User can SSH out to other systems as needed
+- No management via SSH (physical console only)
+
+**Consequences**:
+- No remote administration via SSH
+- Must use physical console for management
+- WireGuard outbound only, no inbound connections
+
+### Lessons Learned
+
+1. **Shellcheck Warnings Can Be Misleading**
+   - SC2120/SC2119 warnings were false positives
+   - Functions intentionally don't use arguments (generate static config)
+   - Used `# shellcheck disable` sparingly, documented why
+
+2. **Compliance Requirements Overlap**
+   - CIS 1.4 (FIM) → FedRAMP AU-7 → CMMC AU.3.059
+   - Single AIDE implementation satisfies all three
+   - Document compliance mappings clearly
+
+3. **Test Framework Scales Well**
+   - Adding 80 new tests was straightforward
+   - BATS + custom helpers pattern works
+   - System tests for VM boot require special handling (libvirt)
+
+### Action Items for Future Sessions
+
+1. Rebuild ISO with new security features
+2. Run VM boot tests after user logout/login for libvirt
+3. Verify FDE runtime behavior in VM
+4. Consider Secure Boot implementation
+5. Update preseed.cfg to remove hardcoded passwords
+
+---
+
+## Entry 2026-02-17 (Session 1): Project Assessment and Test Coverage Analysis
 
 ### Context
 Comprehensive project review after session handoff. User requested full orientation