# Cascades Tucson — Post-DMARC spoofing recheck + yq install (Howard)

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session
- **Date:** 2026-04-21 (UTC)
- **Scope:** Verify tooling health on Howard-Home, verify Mike's DMARC fix is working for Cascades, clean up two missed phishes, then hand off for Intune Phase B-1

---

## Note for Mike

### Good news
Your `_dmarc.cascadestucson.com` change from `p=none` to `p=quarantine; pct=100` is working. Between your 16:34Z sweep yesterday and 20:22Z today, **zero new signature-matching spoofs were delivered**. Two phishes landed after your sweep but before DNS propagation (both show `dmarc=fail action=none` in their headers — DMARC was still observational at delivery). Since the change propagated: nothing. 26-hour clean window.

### Two stragglers I cleaned up
Your 4/20 sweep targeted 7 mailboxes; these two weren't on that list but got hit with same-campaign messages you'd have deleted if you'd seen them:

| Mailbox | When (UTC) | Subject | Origin | Outcome |
|---|---|---|---|---|
| `accounting@` | 4/20 13:41Z | Action Required: Service Termination Alert | 104.168.70.29 (ColoCrossing US, `LANG:zh-cn`) | **Permanently deleted** from Inbox, HTTP 204 |
| `jd.martin@` | 4/20 18:28Z | NSA: Cascadestucson Executed NDA Agreement | 178.211.155.48 (Deltahost DE, `LANG:en`) | **Permanently deleted** from Deleted Items, HTTP 204 |

Both were envelope-spoofed as the recipient themselves, both credential/document-bait phishes from the same operator as yesterday (new IPs but same hoster patterns — ColoCrossing + Deltahost). JD's was already user-deleted before I got to it; accounting@ was still in the Inbox.

### User advisory — please mention when you talk to them
- **accounting@** (whoever checks that shared mailbox — likely Mary Hogan-Padilla): "On 4/20 around 6:41 AM local you got a fake Microsoft password-expiry email. Did anyone click the link? Need to know so we can decide whether to reset creds."
- **JD Martin**: "The DocuSign/NDA email on 4/20 at 11:28 AM local was a phish. Confirm you didn't click through or enter any credentials."

### IP blocking — skipped
You recommended TABL additions for the 4 IPs yesterday. I added the two new IPs (104.168.70.29, 178.211.155.48) to my report but **did NOT add them to TABL** — since DMARC enforcement is working, the additive blocks are redundant. If we see another wave that slips past DMARC, that's the signal to add them.

### DMARC aggregate reports
Still routing to `info@cascadestucson.com` (internal mailbox, no one parsing). Flagged in my morning spoofing-hunt report as the highest-leverage remaining fix. I didn't touch this. Consider pointing `rua` at dmarcian or EasyDMARC (free tiers) so we can see who's spoofing cascadestucson.com in the wild + confirm enforcement empirically.

### `p=reject` readiness
Once we have a week of aggregator data showing no legit senders are quarantined in error, you can bump from `p=quarantine` to `p=reject`. Don't do this blind — the risk is silently breaking a forwarding chain or vendor mail. Aggregator-first, then escalate.

---

## Tooling fixes this session

### Howard-Home state at start
- Ollama local: running (qwen3-coder:30b, nomic-embed-text)
- Ollama Tailscale: running (codestral:22b, qwen3:14b)
- GrepAI watcher: running, indexed 1,978 files / 13,473 chunks / 85.3 MB, steady
- Vault: `D:/vault` present, sops binary present, age keys present

### Problem found: `vault.sh` broken because `yq` missing
`bash D:/vault/scripts/vault.sh get-field ...` was emitting:
```
[ERROR] Neither yq nor Python is available for YAML parsing.
        Install yq or ensure python + yaml-query.py are present.
```

`vault.sh` looks for `yq` first, then a Python fallback via `$SCRIPT_DIR/yaml-query.py`. Neither existed on Howard-Home.

### Fix applied: installed yq v4.53.2 via winget
```
winget install MikeFarah.yq
```
Installed to `C:\Users\Howard\AppData\Local\Microsoft\WinGet\Links\yq.exe`. Verified: `vault.sh get-field` now returns clean values.

### Gap: Python fallback script still missing everywhere
`vault.sh:17,39,49` references `$SCRIPT_DIR/yaml-query.py` but that file doesn't exist in `D:/vault/scripts/` (or anywhere in the vault repo). The fallback path Mike coded for (WDAC / policy-restricted machines) is documented but missing its implementation. Not urgent since yq works on Howard-Home and presumably on DESKTOP-0O8A1RL, but worth committing a `yaml-query.py` helper so the fallback actually fires if yq is blocked on a future machine.

---

## Also done this session
- `/sync` at session start — pulled 4 commits from Mike (MacBook-Air): Syncro API corrections, GuruRMM MSI deploy fix, BirthBiologic onboarding, desertrat.com Mailprotector SBR repair. Nothing Cascades-related.
- Report written: `reports/2026-04-21-post-dmarc-spoofing-recheck.md` (full methodology + headers + delete log)
- Sweep script kept at `C:/tmp-scripts/cascades_scan.sh` for future rechecks (reusable against any domain with `cascadestucson.com` → variable)

## Data artifacts
- `/tmp/cascades_recheck/` — users list, hits.jsonl, per-hit headers, delete log
- `/tmp/cascades_recheck/delete_log/20260421T203252Z_deletions.jsonl` — structured record of the 2 HTTP 204 permanentDelete calls

## What's next (picking up from 4/20 session)
**Intune Phase B-1: Android compliance policy.** See `docs/intune-b1-android-compliance-walkthrough.md` (new this session). Howard-Home executes via admin center this session.