diff --git a/dsh/docker-compose.yml b/dsh/docker-compose.yml
index 3069f08..17a2e7f 100644
--- a/dsh/docker-compose.yml
+++ b/dsh/docker-compose.yml
@@ -13,6 +13,13 @@ name: dsh
 x-dsh-common: &common
   image: dsh:latest
   restart: unless-stopped
+  security_opt:
+    - no-new-privileges:true
+  cap_drop:
+    - ALL
+  read_only: true
+  tmpfs:
+    - /tmp
   environment: &env-base
     DSH_LLM_BASE: http://192.168.20.13:20129/v1
     DSH_LLM_MODEL: auto/best-chat
diff --git a/inbox.txt.tuxedo-lock b/inbox.txt.tuxedo-lock
new file mode 100644
index 0000000..e69de29
diff --git a/todo.txt b/todo.txt
index c381747..573190f 100644
--- a/todo.txt
+++ b/todo.txt
@@ -4,11 +4,11 @@ x 2026-08-25 dsh plugins Phase 1: web + doc summarise (test.md + example.com ver
 x 2026-08-25 dsh image INGEST + GENERATE done (OpenRouter gpt-5 vision + gpt-image-1); saved to workspace images/  +project:family-home-lab +agent:family_home_lab
 (C) BUY AMD 6600  GPU for docker in Nixos  +project:family-home-lab +agent:family_home_lab
 x 2026-08-25 2026-08-25 Add extra links - .35 Docker, .13 Docker and Websites, make an option list   +project:family-home-lab +agent:family_home_lab
-(A) Admin Pi Dashboard view   +project:family-home-lab +agent:family_home_lab
+2026-08-26 Admin Pi Dashboard view   +project:family-home-lab +agent:family_home_lab
 (B) Update obsidian websites and Docker containers notes  +project:family-home-lab +agent:family_home_lab
 x 2026-08-25 2026-08-25 Fonts and layout. Wrong font. Admin    +project:family-home-lab +agent:fam uily_home_lab
 (B) Check apprise consumers still work after basic-auth: n8n + Go dashboard script on .13 need creds added to URL +project:family-home-lab +agent:family_home_lab
-(C) Kitchen Owl: add AI feature (AI to kitchen/recipes) +project:family-home-lab +agent:family_home_lab
+x 2026-08-26 2026-08-26 Kitchen Owl: add AI feature (AI to kitchen/recipes) +project:family-home-lab +agent:family_home_lab
 (C) Fix abandoned websites: sams.home.lab, laravel, t3_react_app (Laravel+T3 part of Lora car-tracker site) +project:family-home-lab +agent:family_home_lab
 x 2026-08-25 Console passwords (sam/jo/harry/finn) all set to: (see admin / change via /account/password) (2026-08-25 rotate) +project:family-home-lab
 x 2026-08-25 Removed Heimdall + Homarr from console (redundant; user removing from caddy) +project:family-home-lab +agent:family_home_lab
@@ -16,5 +16,5 @@ x 2026-08-25 Removed Heimdall + Homarr from console (redundant; user removing fr
 (C) Zrythm: install natively via pkgs.zrythm on a NixOS desktop; access remotely via RustDesk (server already on .35 hbbs/hbbr). NOT a container (no apt/AppImage). +project:family-home-lab +agent:family_home_lab
 (C) AMD 6600 GPU -> .13: install NVIDIA-free AMD GPU in NixOS (for faster MuScriptor/BasicPitch/ML). NixOS driver config needed (amdgpu). +project:family-home-lab +agent:family_home_lab
 x 2026-08-25 dsh conversation sidebar: multi-session persistence + history UI (list/new/delete/switch, auto-named)  +project:family-home-lab +agent:family_home_lab
-(A) DS Harness - ensure no bash or local editing possible   +project:family-home-lab +agent:family_home_lab
+x 2026-08-26 2026-08-26 DS Harness - ensure no bash or local editing possible   +project:family-home-lab +agent:family_home_lab
 (A) REmove Openweb ui - caddy, folder, docker  +project:family-home-lab +agent:family_home_lab(A) Admin Pi Dashboard view   +project:family-home-lab +agent:family_home_lab