Cryptograss:Moods/ops/todo: Difference between revisions
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
Automated edit (via update-page on MediaWiki MCP Server) |
Automated edit (via update-page on MediaWiki MCP Server) |
||
| Line 1: | Line 1: | ||
<todo> | <todo> | ||
- task: "Review [[Cryptograss:Security Situation]] — re's map of the dream state, the root paths, and the vault spills (rev 13633, 11:35Z)" | - task: "Review [[Cryptograss:Security Situation]] — re's map of the dream state, the root paths, and the vault spills (rev 13633, 11:35Z)" | ||
| Line 19: | Line 5: | ||
link: "https://pickipedia.xyz/wiki/Cryptograss:Security_Situation" | link: "https://pickipedia.xyz/wiki/Cryptograss:Security_Situation" | ||
note: "Revised at your 11:33Z corrections; marked proposed until a person verifies it. Still unchecked and left as such on the page: who holds root SSH keys on maybelle, and whether any Jenkins job prints a secret." | note: "Revised at your 11:33Z corrections; marked proposed until a person verifies it. Still unchecked and left as such on the page: who holds root SSH keys on maybelle, and whether any Jenkins job prints a secret." | ||
done: true | |||
- task: "Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunter" | |||
who: justin | |||
kind: merge | |||
link: "https://github.com/cryptograss/maybelle-config/pull/267" | |||
note: "Moved from #emergence, 2 Nov 15:35Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet." | |||
- task: "The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without one" | |||
who: magent | |||
kind: code | |||
note: "Moved from #emergence, 2 Nov 15:35Z (Justin's 11:40Z voice memo). Columns: secret, destination, consumer, why, deploy-time or runtime. re's corrected first rows: #emergence 11:46Z. Open: whether the ‹?name› parse is enough as the source of truth." | |||
- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)" | - task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)" | ||
who: justin | who: justin | ||
| Line 114: | Line 110: | ||
note: "Open questions on own domain vs maybelle subdomain, dedicated hardware vs co-located with Jenkins." | note: "Open questions on own domain vs maybelle subdomain, dedicated hardware vs co-located with Jenkins." | ||
</todo> | </todo> | ||
Revision as of 15:37, 2 November 2026
- ☐Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunterMoved from #emergence, 2 Nov 15:35Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet.
- ☐The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without oneMoved from #emergence, 2 Nov 15:35Z (Justin's 11:40Z voice memo). Columns: secret, destination, consumer, why, deploy-time or runtime. re's corrected first rows: #emergence 11:46Z. Open: whether the ‹?name› parse is enough as the source of truth.
- ☐Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config; magent found root's keys unmanaged on its 11:33Z check.
- ☐Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person.
- ☐Cold start drill, step one: the property map for [[Cryptograss:Drill:Cold Start Rebuild (by block 26,400,000)]]Moved from #emergence, 2 Nov. The page's status still says not started; the map is next. Target block 26,400,000.
- ☐Verify the drill plan on [[Cryptograss:Drill:Cold Start Rebuild (by block 26,400,000)]]Moved from #emergence, 2 Nov. Cryptograss:Recovery now documents magenta.sh recovery instead.
- ☐Provision a fresh Hetzner box for drill 1 (hunter-only rebuild), once re's property map is doneMoved from #emergence, 2 Nov. Also holds the vault master for drill 2's re-seed. The box is thrown away after the drill.
- ☐Decide where red Jenkins stages surface: a post in #ops (magent's pick) or email per maybelle-config#35cron-health's podcast-import stage has been failing on result: HELD since about Oct 10 and nobody saw it. On a yes to #ops, magent opens the maybelle-config PR; a Mood-post token goes in the vault.
- ☐Verify live endpoint timings on Maybelle post-deployRe-run 02:15Z endpoint timings for /api/moods/ and cold room loads, and re-stamp Cryptograss/Moods/Loading and prefetch (research).
- ☐Implement Realtime Activity Bar Option A (state-flag registry with heartbeat TTL)Replaces 800ms retroactive SQL queries with direct cache key writes on step ingest and heartbeat-extended TTL.
- ☐Decide on dedicated hosting migration for Memory Lane & Postgres per Cryptograss/Magenta hosting migration (contemplation)Open questions on own domain vs maybelle subdomain, dedicated hardware vs co-located with Jenkins.
Done (11)
- ☑Review [[Cryptograss:Security Situation]] — re's map of the dream state, the root paths, and the vault spills (rev 13633, 11:35Z)Revised at your 11:33Z corrections; marked proposed until a person verifies it. Still unchecked and left as such on the page: who holds root SSH keys on maybelle, and whether any Jenkins job prints a secret.
- ☑
- ☑Release or re-budget the held podcast import (354 changes against a budget of 50)Released/completed per Justin in #ops (block 26,303,881).
- ☑Decide yes/no on a PickiPedia page per PR (re answered the record side in #ops; magent the toolchain)Picked up in #ramp (block 26,303,533). pickipedia-mcp#43 opened; ongoing work tracked on Cryptograss:Moods/ramp/todo.
- ☑Fix slow search: web /api/search ~4.4s, memory MCP search 60s+ timeouts (measured 29 Oct)api_search narrows with text__icontains per term (no index); conversations/services/memory.py SearchVector('content') is built per row per query. Fix: stored SearchVectorField + GIN index (and pg_trgm for icontains) via migration.
- ☑Merge magenta#293 and maybelle-config#240, then redeploy maybelleUntangles message send from loadMoods(), caches /api/moods/ with lifecycle invalidation, and ups gunicorn workers from 2 to 4.
- ☑Review magenta#318 (notification jump in one ask, mask dismissal, catch-up pane, recall cache), merge, redeploy maybelleMerged 31 Oct 15:09Z and deployed (per Justin, 17:46Z). Bell prefetch still needs a signed-in check.
- ☑
- ☑
- ☑Merge magenta#338 (Moods list built incrementally) and maybelle-config#252 (cache kept across deploys), redeploy maybelleEither order. After the redeploy, magent re-reads /api/moods/ Server-Timing.
- ☑