docs(session): session id, HUD format, SOR baseline, howto notes

SOR-BASELINE.md

@@ -0,0 +1,20 @@
+# SOR-BASELINE — reachableceo vertical (2026-08-28T11:55, verified live)
+
+| System | Endpoint | Path | Status |
+|---|---|---|---|
+| Gitea | git.knownelement.com | tea CLI (HTTPS+token), default login set | VERIFIED (repos listed; see caveat) |
+| Redmine | projects.knownelement.com | ~/.creds/redmine.env API key | VERIFIED (HTTP 200, user id 5 reachableceo, admin:false) |
+| Discourse | community.turnsys.com | ~/.creds/discourse.env API key | VERIFIED (HTTP 200, current_user reachableceo) |
+| Docker registry | git.knownelement.com | ~/.docker/config.json auth | VERIFIED (re-login succeeded) |
+
+Notes:
+- Gitea regression found+fixed: tea had no DEFAULT login ("no gitea login
+  detected" fallback on every call). Now default = git.knownelement.com.
+- Gitea SSH (port 29418): untested from agent runtime (ssh blocked); HTTPS
+  path via tea + git credential helper works. Founder tests SSH if needed.
+- No redmine/discourse SERVER containers on this host (docker ps -a: none,
+  never were on ultix-streaming). Services are remote; local images are
+  on-demand CLI/MCP clients (redmine-cli, discourse-cli, *-mcp).
+- Credentials live in ~/.creds/*.env (mode 600) — never copy into git or
+  crossfeed. CTO vertical blocker "SoR creds on reachableceo" — creds exist
+  and work here; wiring them into CTO stack is a founder decision.