Cryptograss:Moods/security/todo

- task: "Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunter"
  who: justin
  kind: merge
  link: "https://github.com/cryptograss/maybelle-config/pull/267"
  note: "Moved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet."
  done: true
- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)"
  who: justin
  kind: infra
  link: "https://pickipedia.xyz/wiki/Cryptograss:Security_Situation"
  note: "Moved from #ops. The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config."
- task: "Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki password"
  who: justin
  kind: decision
  note: "Moved from #ops. workbench runs as user magent; anyone there pushes as magent-cryptograss and edits as Magent. Tell skyler, rj and fibonacci before it lands."
- task: "Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)"
  who: magent
  kind: code
  note: "Moved from #ops. Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person."
- task: "The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without one"
  who: magent
  kind: code
  note: "Moved from #ops. Columns: secret, destination, consumer, why, deploy-time or runtime. re's skeleton: #ops, 2 Nov 11:45Z. Each row carries the task's when: text. Completeness needs one read of the vault's key list by the password-holder."
- task: "Review and merge maybelle-config#278 (SSH by key only), then redeploy hunter, maybelle, pickipedia and delivery-kid"
  who: justin
  kind: merge
  link: "https://github.com/cryptograss/maybelle-config/pull/278"
  note: "maybelle, pickipedia and delivery-kid offered password SSH (magent's probe, block 26,349,412). Merged 5 Nov 18:18Z; magent's re-probe at block 26,350,449: all four offer publickey only."
  done: true
  done: true
- task: "NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if so"
  who: justin
  kind: infra
  link: "https://members.nearlyfreespeech.net/"
  note: "ssh.nyc1.nearlyfreespeech.net offers publickey, password, keyboard-interactive. NFSN's public FAQ (checked 5 Nov) has no key-only switch, and the SSH password is the member password. So: make the member password long, random and used nowhere else; turn on 2FA for the member login; ask NFSN support for key-only SSH. maybelle's backups and builds reach it by key."
- task: "Merge maybelle-config:magent/apache-2.4.71, then redeploy pickipedia (CVE-2026-119618)"
  who: justin
  kind: merge
  link: "https://magenta.cryptograss.live/ramp/maybelle-config/magent/apache-2.4.71/"
  note: "Apache 2.4.69 → 2.4.71 in the wiki image, mod_http2 off, Protocols http/1.1. Not exploitable as deployed today (no mod_http2, 127.0.0.1 behind Caddy); this keeps it that way."
  done: true
- task: "Redeploy pickipedia after the Apache merge"
  who: justin
  kind: deploy
- task: "NFSN: ask support whether the Apache behind justinholmes.com and cryptograss.live is on 2.4.71 (CVE-2026-119618); both speak HTTP/2"
  who: justin
  kind: infra