Cryptograss:Moods/ramp/todo

- task: "Merge maybelle-config:magent/retire-arthel-branches-builds and magenta:magent/asks-closed-pulls, then redeploy maybelle (one deploy for both)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/retire-arthel-branches-builds/
  note: "9505a0c7: arthel-branches-builds ran any arthel branch's own Jenkinsfile on the controller, with every Jenkins secret, emergents' branches included (it built magent/happenings-pinned today); failing since July. Takes the github-token credential and GITHUB_TOKEN with it. ea99166: rabbithole #29-#33, closed unmerged, kept their asks as pills in #rabbithole. Both: ci/test or the full suite green."
  done: true
- task: "Revoke Jenkins' GitHub token without signing in, BEFORE maybelle's redeploy (while Jenkins still holds it): see note; then redeploy maybelle; then drop maybelle_github_token from the vault"
  who: justin
  kind: infra
  note: "Nobody has cryptograss-maybelle's login (Justin, 00:22Z). GitHub's POST /credentials/revoke takes the token itself, unauthenticated, and notifies the owner (docs.github.com/en/rest/credentials/revoke). As root on maybelle: docker exec jenkins sh -c 'curl -s -o /dev/null -w \"%{http_code}\\n\" -X POST https://api.github.com/credentials/revoke -H \"Accept: application/vnd.github+json\" -d \"{\\\"credentials\\\":[\\\"$GITHUB_TOKEN\\\"]}\"' (expect 202), then the same /user check as at 16:47Z should answer 401. githouse pushes with the account's SSH key, not this token. Done another way: Justin got into the account and deleted the token there (01:12Z), redeployed maybelle (26388419), and dropped maybelle_github_token from the vault (01:35Z)."
  done: true
- task: "Get back into GitHub's cryptograss-maybelle (created 15 Feb 2025): 'Forgot password' with its username mails whichever address it was made with; keep the login and recovery codes where a person can find them"
  who: justin
  kind: infra
  note: "Its SSH key is githouse's push identity to every repository (GitHub credits githouse's merges to it), and nobody has its password (Justin, 11 Nov 00:22Z). If GitHub ever asks it to reauthenticate or turn on 2FA, nobody can."
  done: true
- task: "Merge maybelle-config:magent/scan-streams, then redeploy maybelle: githouse scan streams git's diffs, so it no longer runs out of memory on arthel"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/scan-streams/
  note: "df8137e8. The scan printed nothing on 11 Nov at 01:43Z because the kernel killed it: arthel's history as diffs is 604 MB, held whole, against githouse's 512m. On hunter's mirror, with the same limit: production's code is Killed in 7 s, and this one finishes in 2 min. 79 tests pass."
  done: true
- task: "Merge maybelle-config:magent/scan-faster, then redeploy maybelle: githouse looks for vault values only in printable runs; the whole scan in ~10 minutes, not hours"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/scan-faster/
  note: "211aa604. 11 Nov: the scan ran over an hour on maybelle until Justin's ssh dropped. On hunter's mirror with a stand-in vault: arthel from not finishing 200k lines in 5 min to 7.5 s; maybelle-config 0.44 to 0.84 MB/s. Gives up finding a vault value with a non-printable or non-ASCII character in it."
  done: true
- task: "Run the secret scan on maybelle, after magent/scan-faster is deployed, detached so a dropped ssh can't end it: docker exec -d -u git githouse sh -c 'githouse scan > /srv/git/.scan.txt 2>&1; echo exit $? >> /srv/git/.scan.txt'; ~10 minutes later: docker exec githouse cat /srv/git/.scan.txt; paste magent the output"
  who: justin
  kind: infra
  note: "10 Nov 22:51Z it showed nothing: without -t, docker exec holds the output until the scan ends, which takes minutes (maybelle-config alone was 114 s on hunter's mirror). With -t, lines come as found; or redirect to a file and read it after. It never prints a value. Shape matches in test fixtures are expected (15 from hunter's mirror, all fakes); a 'value from the vault' line is a real leak: rotate first ([[Cryptograss:Runbooks/A key is compromised]])."
- task: "Merge arthel:magent/happenings-pinned (no --remote; the pin moves to happenings main 07c016a0, what the site builds today)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/arthel/magent/happenings-pinned/
  note: "34c7caa. Old pin d6671777 had diverged from main (main 6 ahead; the pin's 'Discord logo.' commit not in main), so pinning main changes nothing visible. No redeploy: arthel-production-build picks it up within 2 minutes. Justin, 22:51Z: happenings' future is unknown, 'I guess it's fine'."
  done: true
- task: "Turn on GitHub's push protection for the cryptograss org (free on public repos): it covers a person pushing straight to GitHub, which githouse never sees"
  who: justin
  kind: infra
  note: "re's point, 19:33Z. Done 11 Nov ~03:50Z: GitHub recommended configuration (secret scanning with push protection, code scanning, Dependabot)."
  done: true
- task: "Read the cryptograss org's secret scanning alerts (Security → Secret scanning) and tell magent each one's type, repository and whether it's still valid, never the value; or give magent-cryptograss the org's security manager role so magent can read them"
  who: justin
  kind: infra
  note: "GitHub scanned every public repository's whole history when the configuration went on. A member can't read the alerts (magent tried: 404 on each repository). A live one: rotate first ([[Cryptograss:Runbooks/A key is compromised]])."
- task: "Triage code scanning's first alerts, criticals first: 7 py/full-ssrf (6 maybelle-config, 1 magenta); then magenta's ~127, maybelle-config's 94 (81 py/path-injection), arthel's 18"
  who: magent
  kind: code
  note: "Counted 11 Nov 03:55Z by gh api. maybelle-config's 94 were scanned on main, 440 commits behind production (its 6 criticals are all in coconut.py, which production removed in ca6414b5): rescan after the default-branch flip. magenta #57 (unfurl.py) refuses private addresses at every hop by design; what's left is DNS rebinding between the check and the fetch."
- task: "Merge magenta:magent/asks-without-github, then redeploy maybelle: #rabbithole's four pills (#29, #31-#33) clear"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/asks-without-github/
  note: "9151e744. Asks are answered from githouse (merged) and the ramp's board (no longer open), never GitHub. Justin, 15:02Z: no GitHub token; 'we're on the cusp of being rid of github altogether'. The token branch is closed."
  done: true
- task: "magent: the rest of memory-lane's GitHub calls (to-do lists, PR cards, status, work search), off GitHub before it goes"
  who: magent
  kind: code
  done: true
- task: "Merge magenta:magent/candidate-page-wait, then redeploy maybelle: opening a candidate's page from the merge sheet shows a spinner, not the ramp list; the link reads 'More details →'"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/candidate-page-wait/
  note: "157dd610. Justin, 14:37Z: pill → sheet → full diff sat on the ramp list. The first opening makes the page, which can wait on a fresh board (12.3 s today); the open frame kept showing the list meanwhile. Making the board faster is still open."
  done: true
- task: "magent: the ramp board takes 12.3 s to build (11 Nov); find where, and make a candidate page's first opening not wait on it"
  who: magent
  kind: code
- task: "Merge maybelle-config:magent/cgit, then redeploy maybelle: githouse's repositories at code.maybelle.cryptograss.live, read-only, with Pygments"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/cgit/
  note: "a8dc343c. Previewed on hunter against its mirror: every page 200, highlighting seen in a browser. No DNS record needed (*.maybelle resolves). Each repo opens on the branch it deploys from."
  done: true
- task: "Merge magenta:magent/long-asks-fresh-branches, then redeploy maybelle: a merge ask up to 600 characters is an ask, whole; the composer's branch list refreshes each minute"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/long-asks-fresh-branches/
  note: "29591ac6. Justin, 14:33Z: ask-repo-space had no pill here (magent's 11:12Z ask ran to 212 characters, over 200, and went out as text) and wasn't in autocomplete (the list was fetched once, at page load). 1984 tests."
  done: true
- task: "Merge magenta:magent/ask-repo-space, then redeploy maybelle: #rabbithole's pills for magenta #5 to #33 go away"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/ask-repo-space/
  note: "d1a68e02. 'rabbithole #29' (a space before the #) was read as magenta#29: 22 old asks in #rabbithole stood as magenta pills. Every rabbithole PR they name is closed, so they all clear. 1982 tests."
  done: true
- task: "Merge maybelle-config:magent/githouse-promote-2 and magenta:magent/promote-button-2, then redeploy maybelle, BEFORE promoting pickipedia (maybelle-config and arthel are fast-forwards: safe with what's deployed since 11:02Z)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-promote-2/
  note: "d28516be: where main has its own commits, production takes them in first (files unchanged) and main fast-forwards, so main stays an ancestor of production, which maybelle-config's deploy scripts require. 5bd3192: the sheet says so. Without it, pickipedia's first promotion would leave main apart from production for good."
  done: true
- task: "Merge maybelle-config:magent/githouse-people, then redeploy maybelle; then add the githouse remote on Justin's laptop (#ramp, 11 Nov 10:2xZ)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-people/
  note: "368eb0f6: people in githouse_people push <name>/* from their own machines, by their inventory key; b531bfa8: on maybelle's public address too (githouse_public), ssh://git@maybelle.cryptograss.live:2222/<repo>.git, no jump host. Needed before GitHub becomes a dumb mirror."
  done: true
- task: "magenta and rabbithole deploy from production too, as maybelle-config, pickipedia and arthel do; main becomes their promoted branch"
  who: magent
  kind: code
  note: "Justin, #ramp, 11 Nov 09:57Z: 'let's have magenta and rabbithole work the same way.' Both deploy from main today. One cutover per repository: create production at main's head, point the deploys and the ramp's merge target at it."
- task: "Verify re's new instruction: propose promoting main when production is stable"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Emergents/Re/Instructions
- task: "Merge maybelle-config:magent/githouse-promote, then redeploy maybelle; then root may promote by hand: docker exec -u git githouse githouse promote <repo>"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-promote/
  note: "A fast-forward where main is behind; a merge with production's files where main has its own commits (pickipedia's #155): never forced. Signed orders with branch: production, into: main do the same, for the button. 87 tests; a dry run on a copy of pickipedia gave production's tree with main's history kept."
  done: true
- task: "Merge magenta:magent/promote-button with maybelle-config:magent/githouse-promote, then one redeploy of maybelle ships both (memory-lane and githouse); then promote maybelle-config, pickipedia and arthel when re or you call it stable"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/promote-button/
  note: "Justin, 11 Nov 09:50Z: main stays the primary branch, the one that never takes a force-push; machines run production; main is brought up to production when things are stable. pickipedia's main has #155 (4f617abc), which production already has another way (pv-verify-all), so its first promotion is a merge, not a fast-forward. Today main is behind: maybelle-config 440 commits (last 14 Sep), pickipedia 144, arthel 9, so CodeQL and Dependabot (default branch) scan and patch code that isn't deployed."
  done: true
- task: "NOW: merge maybelle-config:magent/jenkins-gitconfig-file, then rerun maybelle's deploy with chapter 1 (then hunter, then githouse scan)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/jenkins-gitconfig-file/
  note: "826d5308. The 21:54Z deploy stopped at the docker-exec git config task (a stale .gitconfig.lock in jenkins_home). Jenkins already checks out file:///srv/git, without the trust, so pickipedia-build and the arthel jobs fail on 'dubious ownership' (checked in their console at 21:5xZ). Nothing deploys meanwhile. This mounts a written /etc/gitconfig instead; tested in the Jenkins image, stale lock and all."
  done: "Merged (81ebc2c6) and maybelle redeployed 22:10Z. Checked 22:2xZ: pickipedia-build, arthel-production-build and both fetch jobs SUCCESS from file:///srv/git; githouse keeps refs/github/ (the flip is live), equal to its own on every deploy branch; a probe push with a fake token shape was refused. Left: githouse scan."
  done: true
- task: "FIRST: merge magenta:magent/merge-asks-each (a merge ask stays until what it names merges; every one kept), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/merge-asks-each/
  note: "1fa0080. Justin, 20:28Z: the pending pills vanished (any merge in the Mood cleared every ask; only the newest ask kept). re reviewed, 20:34Z: nothing blocking; expect old unanswered asks to come back as pills for a while. Full suite 1959 OK. Until it's live, the first merge in #ramp clears all pills: use the ramp page."
  done: true
- task: "Verify Cryptograss:Moods/ramp/Plan sections 3, 6 and 7 (revs 15910-15912): the flip as one merge, happenings pinned, where this ends, and where Jenkins' trusted jobs get their code"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "re, 10 Nov 19:33Z, checked against maybelle-config 0335c24f and arthel 34c7caa. Before it, section 6 still said the Jenkins jobs were 'next' and nothing said how a show change reaches the site, or what's left before nothing deploys from GitHub."
  done: "Verified by Justin, rev 15942, 10 Nov 20:38Z"
- task: "Merge magenta:magent/branch-links (a candidate named in a message, magenta:re/foo or magenta#7, links to its page in the ramp), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/branch-links/
  note: "Merged as e563759, 10 Nov ~05:23Z; live after maybelle's redeploy. It didn't tick itself: only GitHub pull request links did (fixed by the item below)."
  done: true
- task: "Merge magenta:magent/todo-branch-merged (an item linking a candidate branch's page ticks when githouse merges or closes it; a closed branch answers its ask), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/todo-branch-merged/
  note: "98d9cd8, from main at e563759. Full suite 1939 OK. No migrations. Justin's ask, #ramp 05:24Z. Once live, this item ticks itself when it merges: the first real test."
  done: true
- task: "Redeploy maybelle: tonight's magenta main (8eb880e: merged-and-bar, re/tiding-torrent-test-url) and maybelle-config production (52dc3a2c: branches-agent-init) aren't live"
  who: justin
  kind: deploy
  note: "Redeployed by Justin ~05:5xZ. Checked 06:0xZ: live is main at fac415d (the wordmark, branch-links and todo-branch-merged are all on the page). Correction: magent's 05:15Z 'not live' check was invalid; it fetched the page signed out, and the merge bar's code is sent only to someone who can merge."
  done: true
- task: "Merge magenta:magent/ask-anywhere (an ask tag on a line of its own counts, with words after it), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/ask-anywhere/
  note: "e2a33a1, from main at fac415d. Justin, #ramp 06:41Z: magent's merge ask showed as text, a goodnight under the tag. Full suite 1943 OK. No migrations. Independent of tick-summary; one redeploy covers both."
  done: true
- task: "Merge magenta:magent/tick-summary (closed is final, kept like merged; the wiki bot's tick says githouse, not only GitHub), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/tick-summary/
  note: "412cab7, from main at fac415d. re's review point (05:42Z). Full suite 1939 OK. No migrations. Small: it can wait for the next maybelle redeploy."
  done: true
- task: "Redeploy hunter: magenta:re/candidates-news changes the poller"
  who: justin
  kind: deploy
  note: "On main since 73f095d (checked 10 Nov 04:48Z). Poller only, so hunter, not maybelle. Redeployed: hunter's containers were recreated 05:59-06:00Z, and the poller's mounted source has the candidates-changed code (checked 06:0xZ)."
  done: true
- task: "Merge magenta:magent/merge-dots (merge asks as one row of small pills, dots and the branch; the sheet leads with title and description; opening a page says nothing in the Mood), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/merge-dots/
  note: "d2b8e93: main (b1d112c, with mood-list-candidates; its ramp.py conflict resolved) and magent/ramp-drops-merged merged in. Justin's asks, #ramp 14:10Z. Full suite 1953 OK. No migrations. Checked in a browser on a local server with githouse's real copy (pills, and the sheet for re/help-install-app)."
  done: true
- task: "Merge magenta:magent/ramp-drops-merged (a merge pressed in a Mood marks the ramp's board old the moment it's merged), with merge-dots, which includes it"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/ramp-drops-merged/
  note: "d61545d. Justin, #ramp 14:13Z: mood-list-candidates, pressed in #interfaces, stayed on the ramp until he left it and came back. The test fails without the fix. Ticks itself when merge-dots merges."
  done: true
- task: "Merge magenta:magent/deploy-stamp (the ramp's 'live on' learns what each deploy put on each server: magenta on hunter, at last)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/deploy-stamp/
  note: "92d77d1, from main at 562e74f. Full suite 1948 OK. No migrations. re to review. Either order with the maybelle-config half: each ignores what the other doesn't send yet."
  done: true
- task: "Merge maybelle-config:magent/deploy-commits (hunter's and maybelle's playbooks note the magenta commit they deployed; report-deploy.sh sends it when the deploy ends)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/deploy-commits/
  note: "1afc8906, from production at 52dc3a2c. ci/test green (playbooks parse, every task's options check); report-deploy.sh's new tests post to a listener of their own. re to review: it's deploy logic."
  done: true
- task: "Redeploy maybelle (magent/ask-anywhere, magent/tick-summary; then deploy-stamp and deploy-commits once merged), then hunter, so the ramp first says 'live on hunter'"
  who: justin
  kind: deploy
  note: "ask-anywhere and tick-summary merged 06:52Z and read 'not yet' on the live ramp (checked 08:1xZ). hunter after maybelle: its report is the first to carry magenta's commit. Done by Justin ~15:57Z: the ramp's 'live on' read 'hunter, maybelle' for everything merged that day."
  done: true
- task: "Merge maybelle-config:magent/repackage-cid-check (/enrich/repackage takes a CID and nothing else), before delivery-kid's redeploy"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/repackage-cid-check/
  note: "1f02a4c5, from production. re's hardening point, 16:26Z. Its test and the 5 repackage tests pass. One redeploy then covers both."
  done: true
- task: "Redeploy maybelle (magent/merge-github-only-branch) and delivery-kid (magent/resdtp-releases, and repackage-cid-check once merged)"
  who: justin
  kind: deploy
  note: "maybelle done: redeployed 16:39Z, magenta 925cd58 (/api/servers/, checked 16:4xZ). delivery-kid and the 26 repackages moved to Cryptograss:Moods/uploads-and-embeds/todo (Justin, 16:42Z: that work lives there)."
  done: true
- task: "Merge magenta:magent/merge-github-only-branch (the merge sheet finds a branch pushed only to GitHub by its pull request: 18 open were 'githouse has no …'), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/magenta/magent/merge-github-only-branch/
  note: "159f5fe, from main. Justin, #ramp 16:10Z. Full suite 1955 OK; the new test fails without it. No migrations. githouse already merges such branches (it reads GitHub's head)."
  done: true
- task: "Merge maybelle-config:magent/resdtp-releases (#298: repackage the 26 older release videos so they play on iPhones), then redeploy delivery-kid"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/resdtp-releases/
  note: "Still open, checked 10 Nov 16:0xZ; delivery-kid runs 52dc3a2c (redeployed 07:12Z), which has the standard-range fix for new videos but not this. Skyler's iPhone is the test."
  done: true
- task: "Redeploy delivery-kid: it runs 9fd62b2d (5 Nov), so the iPhone fix merged 9 Nov 17:39Z (strip-empty-sdtp) isn't live"
  who: justin
  kind: deploy
  note: "Checked /version 10 Nov 04:48Z. Redeployed 07:12Z: /version says 52dc3a2c (checked 16:0xZ), so strip-empty-sdtp is live. #290 and #298 weren't in it; #298 is its own item above."
  done: true
- task: "Verify Cryptograss:Moods/Instructions (revs 15842-15849): merge items link their branch page, deploy items don't; merge and redeploy asks name repo:branch, from any turn; no GitHub pull requests, push and ask by name"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/Instructions
  note: "Before it, the page (rev 14232, 4 Nov) said asks come only from look-only turns and named 'which PR'. Every emergent reads this page on every wake, so this is what teaches the other Moods the ramp."
  done: "Verified by Justin, rev 15853, 10 Nov 16:10Z"
- task: "Verify Cryptograss:Moods/ramp/Plan: six revisions of magent's since your last verify (rev 14836, 6 Nov), in sections 8, 10 and 11"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "Section 8 (merging without a PR, as built), 10 (rev 15035: one tier, phone merges everywhere; no merge can take away your way to stop it), 11 (branch tests on Jenkins, after re's review). Then 10 Nov 08:03-08:05Z (revs 15808-15818, Justin's ask at 08:03Z): stale lines corrected in sections 1-3, and a dated 'Built' or 'As of 10 Nov' line in 4, 6, 8, 9, 10 and 11, so the page says what's running. One verify covers all of it."
  done: "Verified by Justin, rev 15865, 10 Nov 16:37Z"
- task: "Verify Cryptograss:Runbooks/A key is compromised: never verified; all 8 revisions are magent's"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Runbooks/A_key_is_compromised
  note: "Newest is 15094 (8 Nov 02:15Z: the brakes and AZ5 live). Its freeze brake is rev 15038."
  done: "Verified by Justin, rev 15866, 10 Nov 16:38Z"
- task: "Verify re's candidates-changed and candidates-same lines on Cryptograss:Emergents/Wake (rev 15582)"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Emergents/Wake
  note: "re's edit, 9 Nov 17:54Z, after your 17:42Z verify. Until verified, the poller sends the same words from poller/wake_texts.md."
  done: "Verified by Justin, rev 15867, 10 Nov 16:38Z"
- task: "Delete magenta's dead production branch on GitHub (a634f16, Nov 2025), or say it stays"
  who: justin
  kind: decision
  note: "Still there, checked 10 Nov 05:15Z. It's why the ramp measured every magenta branch with no pull request against a year of history (+85,583 lines). The ramp routes around it now; deleting it removes the trap for anything else that guesses production first."
  done: "Deleted: GitHub answers 404 for magenta's production branch, checked 10 Nov 16:4xZ"
- task: "Check which account maybelle_github_token (Jenkins' github-token) belongs to and its scopes, without printing it: pickipedia and arthel merges run code in Jenkins with it"
  who: justin
  kind: infra
  note: "If it can administer the org, a merge there can change the org and its deploy keys (Plan, section 10, open)."
  done: "Checked by Justin 10 Nov 16:47Z: classic token of cryptograss-maybelle (org member, not owner; write on all seven repos, checked by magent with gh). Scopes gist, public_repo, read:project, read:user, repo:status, user:email, write:discussion. No admin:org, no admin rights: it can't touch the org or deploy keys. But public_repo plus write means it can push to every repo's deploy branch on GitHub, around githouse. Follow-up below."
- task: "Jenkins' GitHub token (maybelle_github_token): since 10 Nov only arthel-branches-builds uses it (scan, clone, preview comments). Narrow it to read-only, or remove it with that job"
  done: "Superseded, 10 Nov 23:1xZ: the job is retired (magent/retire-arthel-branches-builds) and the token gets deleted, both items above"
  who: justin
  kind: infra
  note: "Today's classic token can push to maybelle-config production and magenta main on GitHub without githouse, and deploys still clone from GitHub, so a pushed commit reaches the next deploy. Code run by Jenkins on the controller (arthel, pickipedia builds) can read it from the environment. Jenkins only reads repos and posts preview comments on justinholmes.com commits; if a fine-grained token can't comment without Contents write, drop the comment. Goes with magent's 'deploys clone from githouse' item, which closes the same hole from the other side. A person makes the token and puts it in the vault."
- task: "hunter's disk (82%, warning at 85%): decide whether hunter prunes unused images, which the playbook leaves alone on purpose"
  who: justin
  kind: decision
  done: "Moved to Cryptograss:Moods/ops/todo, Justin 10 Nov 16:42Z"
  note: "Punted, Justin 07:15Z. Checked 10 Nov 06:5xZ. The housekeeping role says unused images are 'deliberately left alone ... That is a human decision.' magent's 30.1 GB figure was docker's 'reclaimable', which counts layers shared with images in use (magenta:latest is 10.6 GB and runs four containers). Tagged images no container uses come to ~7 GB: playwright/mcp 1.4 GB (10 months old), php:8.2.35-apache twice (715 MB each), groovy:4.0-jdk17 707 MB, memory-lane-source-watcher 639 MB, then many small ones. If yes, magent writes the maybelle-config change: a weekly 'docker image prune -a' for images unused a week or more, beside the build-cache prune."
- task: "hunter's ssh router refuses a banned person's key; a redeploy prints any change in people, keys, githouse_mergers or MOOD_ADMINS (scripts/render_diff.py)"
  who: magent
  kind: code
  note: "Plan section 10. Not built: neither is on maybelle-config production (52dc3a2c), checked 10 Nov."
- task: "A deploy watch (server, commit): deploys stamp the commit they deployed, and the Mood is told"
  who: magent
  kind: code
  note: "Plan, section 4. The merge half is done (#415; #444 says githouse's merges in their Mood). Built 10 Nov 08:2xZ as magent/deploy-stamp and maybelle-config:magent/deploy-commits (above). Found while building: the ramp already knew magenta on maybelle and maybelle-config everywhere; hunter's magenta was the gap. Not yet: a redeploy ask resolving on the commit rather than on any finished deploy; pickipedia's code, which Jenkins deploys."
  done: true
- task: "Deploys clone from githouse's copy on maybelle instead of GitHub (Jenkinsfiles, deploy scripts)"
  who: magent
  kind: code
  note: "re's point 9. Justin's go, 10 Nov 16:54Z. Built as maybelle-config:magent/githouse-owns (36a265eb), the flip too: githouse had taken the deploy branches from GitHub every minute, so cloning from it alone closed nothing. Jenkins' pickipedia and arthel jobs are the item below."
  done: true
- task: "Review maybelle-config:magent/githouse-owns: githouse owns main/production (GitHub a mirror; ahead or apart there is never taken; root's adopt); maybelle, hunter and the deploy scripts fetch from githouse"
  who: re
  kind: review
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-owns/
  note: "Look hardest at reconcile() and _merge(): can anything still move a deploy branch here from GitHub without root's adopt? And the cold-start fallbacks: can anything but a missing githouse trigger them?"
  done: "re, 17:14Z: sound but one hole, a deploy branch's name new on GitHub was taken and could retire live branches unsigned; fixed on re/githouse-owns-new-names (911602e1), 57 tests, checked by magent"
- task: "Merge maybelle-config:magent/jenkins-from-githouse (brings re/githouse-owns-new-names and magent/githouse-owns: all three at once), redeploy maybelle, then hunter"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/jenkins-from-githouse/
  note: "Justin, 17:55Z: build the Jenkins part now and merge together. 0335c24f; re to review the Jenkins half (her lane). re reviewed and fixed the flip, 17:14Z. ci/test green (githouse 56). The first hunter deploy after merging runs the old deploy-hunter.sh (from GitHub); the playbook parts take effect at once. After this, a GitHub-button merge doesn't deploy: githouse logs it, and root adopts it."
  done: true
- task: "Jenkins' pickipedia and arthel jobs check out from githouse (a fetch-only key for Jenkins), so those deploys stop following GitHub's production"
  who: magent
  kind: code
  note: "Built as maybelle-config:magent/jenkins-from-githouse (0335c24f), stacked on the flip. Tested on a throwaway Jenkins: builds from a githouse-owned repo; without safe.directory it fails as it should. Left on GitHub: branch-tests (not a deploy), arthel-branches-builds, rabbithole on the pickipedia VPS, pickipedia-mcp in hunter's image, blue-railroad-import."
  done: true
- task: "The rest still deployed from GitHub: rabbithole (pickipedia VPS), pickipedia-mcp (hunter's image), blue-railroad-import (Jenkins image; not in githouse)"
  who: magent
  kind: code
  note: "After jenkins-from-githouse."
- task: "Decide happenings: arthel's integration/Jenkinsfile runs 'git submodule update --remote', so GitHub's happenings main reaches justinholmes.com within 2 minutes, unsigned. Drop --remote (the pin in arthel decides; magent's pick) or add happenings to githouse with an insteadOf (re's)"
  who: justin
  kind: decision
  note: "Found by re, 18:01Z; true before the flip too. happenings is private and its last commit was 26 Feb 2025 (EhlJai's PRs), checked 10 Nov. In githouse it would be in hunter's mirror, readable from every container."
  done: "Drop --remote: magent and re agree (19:10Z), Skyler asked for the best bet (19:11Z). Built as arthel:magent/happenings-pinned, below"
- task: "Review maybelle-config:magent/githouse-secret-check: pre-receive refuses a vault value (the scrubber's list, kept on maybelle) or a secret's shape; githouse scan; the githouse command on the PATH"
  who: re
  kind: review
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-secret-check/
  note: "re's first review (19:42Z): not ready, 5 of 7 plantings missed, and plaintext where hashes were promised. Reworked as 622e2e2f: hashes only, messages in their own pass, every non-removal diff line, --text, merges by --remerge-diff. A test per planting; 6 fail on the old code. ci/test green (githouse 76); the image builds and tests on git 2.39.5. Re-review."
  done: "re's second look, 19:55Z: holds, with two additions (0x-prefixed values; octopus merges refused), both in f8b1c6d4, each with a test that fails on 622e2e2f. githouse 79."
- task: "Merge maybelle-config:magent/githouse-secret-check, redeploy maybelle with chapter 1 (it brings the vault list), then run the history scan: docker exec -u git githouse githouse scan"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/maybelle-config/magent/githouse-secret-check/
  note: "Reviewed by re twice; f8b1c6d4 includes jenkins-from-githouse, so merging it alone brings all four. The scan prints commit, file and kind, never the value. Shape hits found from hunter's mirror (15) are all fixtures or placeholders; a 'value from the vault' hit is real and gets rotated first ([[Cryptograss:Runbooks/A key is compromised]])."
  done: true
- task: "Merge rabbithole:magent/gitignore-env (.env and .env.local ignored)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/rabbithole/magent/gitignore-env/
  note: "One line. No redeploy."
  done: true
- task: "Back up /mnt/persist/githouse: since the flip it holds the canonical deploy branches, refs/merged and refs/closed, the merge records (.merges) and its host key; never secrets.json, which chapter 1 rewrites from the vault"
  who: magent
  kind: code
  note: "Plan section 6: nothing backs it up (checked 10 Nov). GitHub has each deploy branch; hunter's mirror has the refs. The rest has no second copy."
- task: "The ramp shows githouse's github.json: a deploy branch GitHub has moved around githouse (ahead or apart)"
  who: magent
  kind: code
  note: "After githouse-owns is live. Until then it's only in githouse.log."
- task: "Jenkins audit, re's open items: a policy on silent skips (pickipedia node/lua checks), pickipedia's chain-data warning that deploys stale silently, NVM/pnpm fetched from the network in every pipeline"
  who: re
  kind: code
  note: "From re's test map, 30 Oct. The mtime guard (#244) and the alarms (#402, #275) are done."
- task: "Review the reworked maybelle-config#250 (githouse on maybelle, mirror on hunter; your ten points of 2 Nov folded in)"
  who: re
  kind: review
  link: https://github.com/cryptograss/maybelle-config/pull/250
  note: "Reviewed 6 Nov 04:44Z: sound, two bugs found (the hooks lacked the deploy key; the port check was inverted), both fixed on the branch by magent from re's description."
  done: true
- task: "Merge maybelle-config#250 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/250
  note: "Merged 05:01Z (07cb4d10); maybelle redeployed 05:08Z, failed=0, every githouse task ran. githouse's sshd answers on 10.0.0.2:2222, key only, and nothing on maybelle's public address."
  done: true
- task: "Redeploy hunter for #250: the mirror, and the containers' keys"
  who: justin
  kind: deploy
  note: "Done 05:22Z. The relay worked (keys on maybelle, authorized_keys written), but sshd refused them all: the git account was locked. Fix below."
  done: true
- task: "Merge maybelle-config#280 (githouse: the git account was locked) and redeploy maybelle (then hunter at its next deploy)"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/280
  note: "useradd left the git account locked ('!'); sshd refuses a locked account even by key. Reproduced and fixed in a throwaway container on hunter, 6 Nov 05:35Z. After maybelle's redeploy, the mirror fills within a minute and pushes work."
  done: true
- task: "Confirm jenkins_github_ssh_key can push to the org's repos: after hunter's redeploy, re pushes a branch to hunter and magent reads githouse.log on maybelle for a forward failure"
  who: magent
  kind: test
  note: "6 Nov 05:42Z: yes. magent pushed magenta:magent/githouse-smoke to maybelle from its container; the branch was on GitHub within seconds and in hunter's mirror within a minute."
  done: true
- task: "Merge magenta#408 (PR cards look at GitHub hourly), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/408
  note: "Merged 04:57Z and live (magenta at 3a57cb2a)."
  done: true
- task: "maybelle-config#246 (read-only GitHub token for memory-lane): merge or close"
  who: justin
  kind: decision
  link: https://github.com/cryptograss/maybelle-config/pull/246
  note: "Optional now that #408 is live. Justin, 6 Nov: no appetite for another token. Close it unless the asks starve again. Closed on GitHub 7 Nov 00:40Z."
  done: true
- task: "Re-verify Cryptograss:Moods/ramp/Plan: section 5 rewritten per your 6 Nov decisions (main stays default, merge commits only, no rulesets)"
  who: justin
  kind: verify
  link: "https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan"
  note: "Verified 6 Nov 11:22Z at rev 14724; section 5 rewritten 19:57Z; re-verified by Justin 22:49Z (rev 14836)."
  done: true
- task: "Set each repo's GitHub default branch to the branch that deploys"
  who: justin
  kind: infra
  note: "Dropped, Justin 6 Nov 11:22Z: main stays the default, the branch where history is final; the deploy branch stays per-repo config (#376). The mains catch up to the productions after the ramp settles: arthel and maybelle-config are fast-forwards, pickipedia has 2 commits on main not on production, magenta's production is dead (3 commits, Nov 2025)."
  done: true
- task: "Merge commits only (squash and rebase off) on pickipedia-mcp, the one of the six still allowing both"
  who: justin
  kind: infra
  link: https://github.com/cryptograss/pickipedia-mcp/settings
  note: "Done. 7 Nov 00:39Z, read back with gh api: all six repos githouse copies are merge-commit only; squash and rebase off everywhere."
  done: true
- task: "Rulesets on the branches that deploy (PR required, no force-push, no deletion; admins bypass)"
  who: justin
  kind: infra
  note: "Dropped, Justin 6 Nov 11:22Z: no further entrenching GitHub. githouse's check() already refuses any push that isn't <name>/*, so no emergent reaches a deploy branch; at the flip GitHub becomes a mirror we push to, and a ruleset is one more thing to undo. Plan section 5 to be rewritten once item 2 is decided."
  done: true
- task: "Merge magenta#333 (repo:branch autocomplete, reading /api/branches/ from maybelle's githouse copy), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/333
  note: "Reviewed by re 1 Nov and 6 Nov. Its mount exists on maybelle since the 05:08Z deploy, so it can go now."
  done: true
- task: "Build the ramp view on magenta: open PRs across our repos, last five merged, who and where, last two mentions, sorted by last push or last mention, temperature"
  who: magent
  kind: code
  link: https://github.com/cryptograss/magenta/pull/420
  note: "Built as /moods/pulls/ in magenta#420, 7 Nov 08:00Z. Plan, section 2."
  done: true
- task: "Review magenta#420, the ramp view (/moods/pulls/)"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/420
  note: "A fix is a re/ branch of your own; magent merges it in (Plan, section 3)."
  done: true
- task: "Merge magenta#420 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/420
  note: "After re's review."
  done: true
- task: "Review magenta#421: the ramp page's mentions from an index kept up from new posts (on maybelle #420's query ran past its 4 s budget)"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/421
  done: true
- task: "Merge magenta#421 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/421
  note: "After re's review. Until then /moods/pulls/ works, without mentions."
  done: true
- task: "Merge magenta#423 (~ opens every mergeable in the composer) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/423
  done: true
- task: "Verify the githouse practices in Cryptograss:Emergents/GeneralOrders (rev 14966)"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Emergents/GeneralOrders
  note: "Verified 9 Nov 17:44Z (rev 15579)."
  done: true
- task: "Decide Plan sections 8 and 9 (merging without a PR; a page per piece of work): verify, or push back"
  who: justin
  kind: decision
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "re reviews the design first. Open questions: SSH signature per merge (CLI, then passkey on the phone) versus trusting a signed-in device; who may merge. Settled by building: merges through githouse since 8 Nov, a page per work since #448; section 10 answered both questions (one tier, githouse_mergers justin and skyler). What's left is the Plan's verify, above."
  done: true
- task: "Review maybelle-config#286: githouse merge, a branch merged on an order signed with a person's SSH key (Plan, section 8)"
  who: re
  kind: review
  link: https://github.com/cryptograss/maybelle-config/pull/286
  done: true
- task: "Merge maybelle-config#286 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/286
  note: "re reviewed it 17:37Z; her notes are fixed in 1ca7f8c7. Since then one commit, 53a17642: githouse_mergers is [justin, skyler] (Justin, 7 Nov 23:53Z), with a test for skyler's RSA key."
  done: true
- task: "githouse brakes: refuse orders by a name banned in memory-lane, and every order during AZ5 or a root-only freeze (magenta.sh freeze); merge nothing while memory-lane doesn't answer"
  who: magent
  kind: code
  note: "Built 8 Nov: githouse's half on maybelle-config#286 (61e88fe8), memory-lane's /api/brakes/ on magent/githouse-brakes. The freeze is /mnt/persist/githouse/etc/frozen, root only; magenta.sh freeze as a wrapper is still to do."
  done: true
- task: "Review the brakes: maybelle-config#286 since 1ca7f8c7 (61e88fe8, 53a17642) and magenta#426 (/api/brakes/)"
  who: re
  kind: review
  link: https://github.com/cryptograss/maybelle-config/pull/286
  note: "Reviewed 8 Nov 00:28Z: two fixes (an unknown name answered 'not banned'; a malformed answer escaped brake()), merged in by magent as 2b4289f7 and 113c488."
  done: true
- task: "Merge magenta#426 and maybelle-config#286, then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/426
  note: "Merged and deployed 8 Nov 02:14Z."
  done: true
- task: "magenta.sh merge: fetch the head itself, show git log and the diffstat it computed (tested: never text a service hands it), sign in magenta-merge, hand to githouse over ssh to maybelle"
  who: magent
  kind: code
  note: "Built 8 Nov as magenta#428 (stacked on #426), sent through memory-lane as a mailbox rather than ssh; githouse fetches orders in maybelle-config#287 (stacked on #286)."
  done: true
- task: "Review the mailbox and magenta.sh merge: magenta#428 and maybelle-config#287"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/428
  note: "Reviewed 8 Nov 01:29Z: two bugs, fixed by re in re/merge-mailbox-fixes (merged in, 47d1176). Her open point, the signature screen at the mailbox with a limit per signer, was done by magent in 9b61b18."
  done: true
- task: "Merge magenta#428 and maybelle-config#287, then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/428
  note: "Merged and deployed 8 Nov 02:14Z. Checked from hunter at 02:15Z: /api/brakes/ answers justin false, skyler false, an unknown name null; the mailbox is empty; /whose/ names both mergers' keys."
  done: true
- task: "The first merge by mail: magenta.sh merge magenta:magent/mergeable-tilde (#423), from an updated magenta checkout"
  who: justin
  kind: test
  link: https://github.com/cryptograss/magenta/pull/423
  note: "Done 8 Nov 03:23Z with #429 instead (#423 went by GitHub's button): 8dd57b26 on main, committed by githouse, 'Signed by justin (githouse merge order 5a83f9084734)', its parents main's tip and exactly #429's head e9f8e601. GitHub marked #429 merged, by cryptograss-maybelle."
  done: true
- task: "Review the merge button: magenta#433 and maybelle-config#289"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/433
  note: "Reviewed 8 Nov 16:56Z: the server side holds; one race in the sheet, fixed by re (re/merge-sheet-race, merged in as a618edd). magent added a guard against opening a sheet while a press is in flight (326744b) and re's memory-lane name assert (1122f499)."
  done: true
- task: "Merge magenta#433 and maybelle-config#289, redeploy maybelle, then press Merge… on something real"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/433
  note: "Merged and deployed 9 Nov 00:34Z. First press 00:38Z: 162b767 on magenta main, 'Merge magenta:journals-section … Pressed by justin, signed by memory-lane'. Follow-up: one green Merged button, magenta#442."
  done: true
- task: "Review Plan section 11: branch tests on Jenkins without its secrets (an agent for branches, credentials scoped to trusted jobs)"
  who: re
  kind: review
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "Reviewed 9 Nov 00:49Z: the branch's own Jenkinsfile could choose the built-in node, so branch jobs run a fixed pipeline from maybelle-config instead; Authorize Project; the whole environment, env_file included. Folded in, rev 15304."
  done: true
- task: "Decide where the branches agent runs: a separate small box (re's and magent's pick) or maybelle behind an internal network and egress proxy"
  who: justin
  kind: decision
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "Justin, 9 Nov 01:00Z: on maybelle; he'll pentest it, and it moves if a real hole turns up."
  done: true
- task: "Review branch tests: maybelle-config#292 (the agent, its network and proxy, the fixed job, githouse's trigger) and magenta#443 (ci/test)"
  who: re
  kind: review
  link: https://github.com/cryptograss/maybelle-config/pull/292
  note: "Reviewed 9 Nov 01:18Z: the agent's secret was readable by ci/test (fixed: ci/test runs as builder through run-ci, 9ed34798); a venv per build, IPv6 off, more proxy checks (same commit); re/ci-test-fixes merged into #443 (acb7aaa). Her item 4, narrowing the reporter, goes with the rest of section 11."
  done: true
- task: "Merge maybelle-config#292 and magenta#443, then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/292
  note: "Merged 9 Nov; the deploy at 01:35Z failed in a second, at playbook load (an apostrophe in the isolation check's heredoc), so nothing ran. Fix: maybelle-config#293."
  done: true
- task: "Merge maybelle-config#293 (the isolation check as a file; ci/test checks playbooks parse) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/293
  note: "Merged; the 01:45Z deploy got halfway and failed on mem_limit (docker_container says memory). Fix: #294."
  done: true
- task: "Merge maybelle-config#294 (memory, not mem_limit; ci/test checks every task's options) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/294
  note: "Merged and deployed 01:56Z: the agent is online, the isolation check passed. branch-tests was on disk but never loaded (a startup race); fix: #295."
  done: true
- task: "Merge maybelle-config#295 (reload Configuration as Code after Jenkins starts; check every job exists) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/295
  note: "Merged and deployed. 9 Nov 02:47Z, end to end: magent pushed maybelle-config:magent/branch-tests-smoke to githouse; githouse asked Jenkins; branch-tests #1 ran on the branches agent through run-ci, every ci/test section green, SUCCESS."
  done: true
- task: "Section 11, the rest: the reporter's Build narrowed to branch-tests and the deploy-report jobs (first: its password is on githouse now); credentials into a folder only the trusted jobs see; the controller's environment emptied (env_file included)"
  who: magent
  kind: code
  link: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan
  note: "Reporter narrowed: maybelle-config#296, merged and deployed 9 Nov 10:51Z. Folder move dropped (Justin, 10:58Z). Emptying the environment, and the trusted agent it needs to mean much, moved to #security (Justin, 11:07Z)."
  done: true
- task: "Merge magenta#448 (a page for each piece of work on Tidings, with its diff and link-to-line; contains #446, the 👍) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/448
  note: "Syntax colours added (3547f52, Justin's ask). re reviewed 15:09Z: nothing blocks; her binary-file 500 fixed in acec0dd. Branch test #9 passed at acec0dd. Two migrations (0050, 0051). Merging #448 merges #446 with it."
  done: true
- task: "Merge magenta#447 (the emergents' activity bar on Tidings and the ramp) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/447
  note: "Branch test #6 passed. Independent of #448; one redeploy covers both."
  done: true
- task: "Review magenta#449: work comments whole in the Mood and Mood replies on the page; one merged line; ramp names link to pages; ask dots; a merge sheet per Mood"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/449
  note: "Reviewed 15:59Z: both places safe; one bug (a refused or expired press hid GitHub's merge line), fixed by re in re/merge-line-refused, merged in as cf51b50. 1861 tests OK."
  done: true
- task: "Merge magenta#449 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/449
  note: "After re's review. No migrations. Full suite 1859 OK locally."
  done: true
- task: "Merge magenta#451 (candidate branches on every wake; the ramp says candidate branch; stacked on #449), then redeploy maybelle and hunter"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/451
  note: "#449 merged 16:37Z. Now also: merge asks one line per candidate with each asker's dot, and answered asks leave the page without a reload (038bdb2). Full suite 1868 OK. No migrations."
  done: true
- task: "Verify the 'candidates' line and the two 'which candidate branch' edits on Cryptograss:Emergents/Wake"
  who: justin
  kind: verify
  link: https://pickipedia.xyz/wiki/Cryptograss:Emergents/Wake
  note: "Until verified, the poller sends the same words from poller/wake_texts.md. Verified 9 Nov 17:42Z (rev 15578)."
  done: true
- task: "Merge magenta:magent/ramp-see-the-diff (every candidate named and linked alike; ± See the diff on each row; the diff first on its page; sizes against main, not magenta's dead production), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/moods/pulls/
  note: "Merged at c9ab117 (with the merge sheet's ± See the full diff) and live by 19:10Z: the ramp's rows read → main."
  done: true
- task: "Merge magenta:magent/sheet-diff-fast (a work's page reads the last board: no ~8 s wait after ± See the full diff), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/moods/pulls/
  note: "Merged as a8197ee."
  done: true
- task: "Merge magenta#452 (sections at /ramp/, /tidings/…; now with main merged in and a candidate's page at /ramp/<repo>/<branch>/, Back returning where it came from), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/452
  note: "0804ab7: also the ramp sorted by Mood and a button per person (only theirs / theirs hidden), Justin's ask 19:47Z. Full suite 1896 OK. No migrations."
  done: true
- task: "Merge magenta:magent/ramp-blocks (pushed in blocks ago; the ramp's column heads sort it), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/
  note: "Merged and live: on 10 Nov 01:19Z all 51 open rows read in blocks, and the four heads sort."
  done: true
- task: "Merge magenta:magent/merge-bar (Merge now: the sheet goes, a bar below the nav with ✓ or ✗; the ramp drops what merged), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/
  note: "Merged as 07a6f53 and deployed by 10 Nov 01:17Z."
  done: true
- task: "Close magenta#442 (the sheet's green Merged button): superseded by magent/merge-bar"
  who: justin
  kind: decision
  link: https://github.com/cryptograss/magenta/pull/442
  note: "Closed; magent deleted its branch on githouse, 10 Nov 04:5xZ, so it leaves the ramp."
  done: true
- task: "Merge magenta:magent/merged-and-bar ('Merged lately' lists every branch githouse merged; the merge bar on every page), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/
  note: "Merged as 8eb880e, 10 Nov ~04:53Z; live after maybelle's next redeploy."
  done: true
- task: "FIRST: merge magenta:re/tiding-torrent-test-url. main fails two ReleaseTorrentTest tests since #452 moved tidings to /tidings/, so every magenta branch tests red until it merges"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/
  note: "Checked 10 Nov 01:20Z: both fail on main (07a6f53); branch-tests #31 passed on re's fix. Tests only, nothing to redeploy. Merged by Justin, 10 Nov ~04:53Z."
  done: true
- task: "Merge maybelle-config:magent/branches-agent-init (the branches agent gets an init as PID 1; an aborted build no longer jams the next), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/ramp/
  done: true
  note: "Merged 10 Nov 04:31Z (52dc3a2c); live after the next maybelle redeploy. cfd176c0, with production merged in. Second half (10 Nov): #34 was aborted, run-ci's cleanup never ran, its workspace stayed builder's, and #35-#36 failed at deleteDir. run-ci now cleans up when stopped (a trap, ci/test waited for in the background), and the job runs 'run-ci reclaim' before deleteDir; tried in a throwaway image on hunter: a TERM mid-test cleaned up in 0 s, a jammed workspace reclaimed and deleted. First half: 80925401. Branch tests #19-#21 failed on 'Resource temporarily unavailable': the agent's java was PID 1 and reaped nothing, so orphaned git and sh stayed <defunct> until all 2048 pids were held (Justin's ps, #ramp 18:59Z). The 19:10Z redeploy cleared them for now; this stops them piling up again. Its own branch test, #22, passed."
- task: "Merge magenta:re/candidates-news (the whole candidate list on a session's first wake in a Mood, then only what changed), then redeploy hunter"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/moods/pulls/
  note: "bfa95f6b, from main. Full suite 1873 OK. No migrations; poller only, so hunter, not maybelle. Merged (on main at 73f095d, checked 10 Nov 04:48Z); hunter's redeploy still owed."
  done: true
- task: "Merge magenta:re/test-cache-own (test runs get a cache of their own; the test_moods flakes)"
  who: justin
  kind: merge
  link: https://magenta.cryptograss.live/moods/pulls/
  note: "2e4488c6. Tests only, nothing to redeploy. Merged (on main at 73f095d, checked 10 Nov 04:48Z)."
  done: true
- task: "Merge magenta#442 (the sheet's green Merged button) and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/442
  done: true
- task: "memory-lane tells the Moods what githouse merged, from /srv/git/.merges (read-only mount)"
  who: magent
  kind: code
  note: "Built 9 Nov as magenta#444 (the Mood an order came from gets the merged line)."
  done: true
- task: "Merge maybelle-config#296 (the reporter starts only branch-tests and deploy-hunter), magenta#444 (merges by mail said in their Mood) and magenta#445 (red and green on the ramp), then redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/maybelle-config/pull/296
  note: "All three passed their branch tests on Jenkins (#2, #3; #445 is #4 when githouse sends it)."
  done: true
- task: "Review magenta#415: merge asks and to-do ticks read merged from githouse's copy (refs/pull/N/head ancestry; refs/merged/ for a repo:branch), GitHub only as fallback"
  who: re
  kind: review
  link: https://github.com/cryptograss/magenta/pull/415
  note: "Reviewed 7 Nov 00:55Z: two real findings (an unguarded subprocess; an ask naming an unknown repo could clear on its known half). re pushed the fixes as re/fix-asks-and-githouse (05e515c), her first commit through githouse; magent merged it with one correction (her clearing condition stood every ask). 1741 tests pass."
  done: true
- task: "Merge magenta#415 and redeploy maybelle"
  who: justin
  kind: merge
  link: https://github.com/cryptograss/magenta/pull/415
  note: "After re's review."
  done: true