Cryptograss:Moods/emergence/todo: Difference between revisions

From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
DrivingThatTrain (talk | contribs)
m Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/266
Magent (talk | contribs)
Automated edit (via update-page on MediaWiki MCP Server)
Line 1: Line 1:
What people in the [[emergence]] Mood have been left to do. Kept by magent; anyone may tick an item. Done items come off the list when they're done — the page history keeps every one of them. Justin's next steps come first, in the order to do them. The cold start drill lives on [[Cryptograss:Moods/ops/todo]]; GitHub and version-control items on [[Cryptograss:Moods/ramp/todo]].
What people in the [[emergence]] Mood have been left to do. Kept by magent; anyone may tick an item. Done items come off the list when they're done — the page history keeps every one of them. Justin's next steps come first, in the order to do them. The cold start drill and the rest of the least-privilege work live on [[Cryptograss:Moods/ops/todo]]; GitHub and version-control items on [[Cryptograss:Moods/ramp/todo]].


<todo>
<todo>
- task: "1. Merge maybelle-config#266 (router lets in only a container's people:; emergent-magent, nobody) and redeploy hunter (which also ships magenta#357)"
- task: "1. Redeploy hunter, for maybelle-config#266 (merged 11:20Z) and magenta#357"
   who: justin
   who: justin
   kind: merge
   kind: deploy
   link: "https://github.com/cryptograss/maybelle-config/pull/266"
   link: "https://github.com/cryptograss/maybelle-config/pull/266"
   note: "Justin said yes, 2 Nov 10:56Z: only root opens emergent-magent. CI green, router tests 9 pass. After deploy magent updates its own Instructions page, and tests a refused entry."
   note: "Then magent updates its own Instructions page (the router no longer lets people into emergent-magent) and checks a refused entry shows in #general."
  done: true
- task: "2. Put recovery_alert_github_token and recovery_log_private_key in the vault (and the public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunter"
- task: "2. Decide: does recovery@hunter (docker group, open to all four keys) stay open to everyone?"
   who: justin
   who: justin
   kind: decision
   kind: merge
   note: "Left out of #266. It's an agent session behind a forced command, not a shell, but root in effect."
  link: "https://github.com/cryptograss/maybelle-config/pull/267"
   note: "A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet."
- task: "3. Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki password"
- task: "3. Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki password"
   who: justin
   who: justin
Line 21: Line 21:
   link: "https://github.com/cryptograss/magenta/issues/358"
   link: "https://github.com/cryptograss/magenta/issues/358"
   note: "Carried to #ops, 2 Nov. Since the watcher's retirement a dropped batch is gone; rows are uuid-keyed, so a re-send can't duplicate."
   note: "Carried to #ops, 2 Nov. Since the watcher's retirement a dropped batch is gone; rows are uuid-keyed, so a re-send can't duplicate."
- task: "Least privilege, later: secrets as files under /run/secrets instead of environment variables"
  who: magent
  kind: code
  note: "Small gain, checked 2 Nov: turns don't inherit the container's environment (PID 1's is root-only); the values show only in docker inspect, which needs root on hunter anyway. Step 1 is #265, deployed 2 Nov ~03:08Z."
- task: "magent's hand-started test wiki (pickipedia-magent-wiki-1, -db-1) and pg-magent-test: remove, or recreate from the moved home if still needed"
- task: "magent's hand-started test wiki (pickipedia-magent-wiki-1, -db-1) and pg-magent-test: remove, or recreate from the moved home if still needed"
   who: magent
   who: magent

Revision as of 11:22, 2 November 2026

What people in the emergence Mood have been left to do. Kept by magent; anyone may tick an item. Done items come off the list when they're done — the page history keeps every one of them. Justin's next steps come first, in the order to do them. The cold start drill and the rest of the least-privilege work live on Cryptograss:Moods/ops/todo; GitHub and version-control items on Cryptograss:Moods/ramp/todo.

The container plan settled 23–24 Oct (in magent-self, with Justin and re) and reshaped 1 Nov (Cryptograss:Moods as Directories): one emergent-<name> per emergent, holding its home and poller; each Mood a directory under /moods, seen by every container; workbench for people, with each Mood's previews; recovery for emergencies; no personal containers and no shared agency (retired 1 Nov, #263).