security: remove inherited env placeholder

Jaime Fournier <jaimef@linbsd.org>

debab54338721dfe0487b802aa1cfd99c10cb0c3

diff --git a/docs/kimi3-security-recommmendations.md b/docs/kimi3-security-recommmendations.md
index 28d6456..a5f4486 100644
--- a/docs/kimi3-security-recommmendations.md
+++ b/docs/kimi3-security-recommmendations.md
@@ -958,11 +958,15 @@ Standardize on `(std security secret)` (auto-wipe lifetimes) +
 command-line argv (`ps`-visible — Philosophy rejects this), secrets in
 error messages/logs. Scanner rules from P2-05 enforce going forward.
 
-- **Status:** started for repository-local MCP logging. `mcp/server.ss` now
-  centrally redacts sensitive MCP request fields, env overrides, free-form
-  command strings with secret markers, and slow-process log entries before
-  writing `JERBOA_MCP_LOG_FILE`. A runtime smoke verified that a fake token in
-  `jerboa_eval` env/command plumbing reaches the log only as `<redacted>`.
+- **Status:** complete for active repository-local surfaces. The sweep found
+  no live secret-bearing CLI flags under `lib/`, `mcp/`, `lsp/`, or `tools/`.
+  `mcp/server.ss` now centrally redacts sensitive MCP request fields, env
+  overrides, free-form command strings with secret markers, and slow-process
+  log entries before writing `JERBOA_MCP_LOG_FILE`. A runtime smoke verified
+  that a fake token in `jerboa_eval` env/command plumbing reaches the log only
+  as `<redacted>`. The retired DJB-style service supervisor no longer carries
+  an `envp = NULL` inheritance placeholder; any future re-enable must build an
+  explicit `(std security env)` envp.
 
 ### K3-P2-08 — SHSTK default decision for daemon binaries
 **Serves:** G1. **Effort:** 2 days.
diff --git a/lib/std/service/supervise.ss b/lib/std/service/supervise.ss
index fcd464d..1dcb279 100644
--- a/lib/std/service/supervise.ss
+++ b/lib/std/service/supervise.ss
@@ -273,8 +273,10 @@
                                        (put-char (+ j 1)))))
                                  (foreign-set! 'void* argv (* i 8) cs))
                                (fill (+ i 1) (cdr args)))))
-                         ;; envp = NULL (inherit current environment)
-                         (posix-execve run-path argv 0))
+                         ;; A future exec-based supervisor must build envp through
+                         ;; (std security env). Do not fall back to NULL envp.
+                         (error '%retired-supervise!
+                                "service launch must build an explicit env-policy envp"))
                        ;; If exec fails, exit child
                        (posix-exit 111))
                      ;; === Parent process ===