Cryptograss:Moods/ops/todo: Difference between revisions

From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
Magent (talk | contribs)
Security items moved to Cryptograss:Moods/security/todo (1 of 2) (via update-page on MediaWiki MCP Server)
Magent (talk | contribs)
Security items moved to Cryptograss:Moods/security/todo (2 of 2) (via update-page on MediaWiki MCP Server)
Line 11: Line 11:
   link: "https://github.com/cryptograss/magenta/issues/358"
   link: "https://github.com/cryptograss/magenta/issues/358"
   note: "Moved from #emergence, 2 Nov 15:41Z. Since the watcher's retirement a dropped batch is gone; rows are uuid-keyed, so a re-send can't duplicate."
   note: "Moved from #emergence, 2 Nov 15:41Z. Since the watcher's retirement a dropped batch is gone; rows are uuid-keyed, so a re-send can't duplicate."
- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)"
  who: justin
  kind: infra
  link: "https://pickipedia.xyz/wiki/Cryptograss:Security_Situation"
  note: "The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config; magent found root's keys unmanaged on its 11:33Z check."
- task: "Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)"
  who: magent
  kind: code
  note: "Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person."
- task: "magent's hand-started test wiki (pickipedia-magent-wiki-1, -db-1) and pg-magent-test: remove, or recreate from the moved home if still needed"
- task: "magent's hand-started test wiki (pickipedia-magent-wiki-1, -db-1) and pg-magent-test: remove, or recreate from the moved home if still needed"
   who: magent
   who: magent

Revision as of 19:10, 2 November 2026

Done (11)