Cryptograss:Moods/ramp/todo

• ☐
  maybelle-config#246 (read-only GitHub token for memory-lane): merge or close

  decision · justin

  Optional now that #408 is live. Justin, 6 Nov: no appetite for another token. Close it unless the asks starve again.
• ☐
  Re-verify Cryptograss:Moods/ramp/Plan: section 5 rewritten per your 6 Nov decisions (main stays default, merge commits only, no rulesets)

  verify · justin

  Verified 6 Nov 11:22Z at rev 14724; magent's section 5 edit at 19:59Z needs a fresh verify.
• ☐
  Merge commits only (squash and rebase off), merge queue off, on every repo githouse copies

  decision · justin

  6 Nov: squash and rebase still allowed on all six, though every PR merge on the four deploy branches in the last 30 was a merge commit. Justin asked why; magent answered 11:30Z. githouse reads 'merged' from git (tip in the deploy branch's history, not on its first-parent line); a squash or rebase makes it 'closed' and a watch never resolves. Justin's call.
• ☐
  Build the ramp view on magenta: open PRs across our repos, last five merged, who and where, last two mentions, sorted by last push or last mention, temperature

  code · magent

  Justin's memo, 30 Oct; the records half (cards) is live. Plan, section 2.
• ☐
  Watches: merge and deploy asks resolved by commit ancestry against githouse's copy; deploys stamp the commit they deployed

  code · magent

  After githouse is live on both servers. Plan, section 4. Deploy stamping is the prerequisite nothing does yet.
• ☐
  Deploys clone from githouse's copy on maybelle instead of GitHub (Jenkinsfiles, deploy scripts)

  code · magent

  re's point 9: its own PR, after githouse has run a few days.
• ☐
  Jenkins audit, re's open items: a policy on silent skips (pickipedia node/lua checks), pickipedia's chain-data warning that deploys stale silently, NVM/pnpm fetched from the network in every pipeline

  code · re

  From re's test map, 30 Oct. The mtime guard (#244) and the alarms (#402, #275) are done.

Done (9)

• ☑
  Review the reworked maybelle-config#250 (githouse on maybelle, mirror on hunter; your ten points of 2 Nov folded in)

  review · re

  Reviewed 6 Nov 04:44Z: sound, two bugs found (the hooks lacked the deploy key; the port check was inverted), both fixed on the branch by magent from re's description.
• ☑
  Merge maybelle-config#250 and redeploy maybelle

  merge · justin

  Merged 05:01Z (07cb4d10); maybelle redeployed 05:08Z, failed=0, every githouse task ran. githouse's sshd answers on 10.0.0.2:2222, key only, and nothing on maybelle's public address.
• ☑
  Redeploy hunter for #250: the mirror, and the containers' keys

  deploy · justin

  Done 05:22Z. The relay worked (keys on maybelle, authorized_keys written), but sshd refused them all: the git account was locked. Fix below.
• ☑
  Merge maybelle-config#280 (githouse: the git account was locked) and redeploy maybelle (then hunter at its next deploy)

  merge · justin

  useradd left the git account locked ('!'); sshd refuses a locked account even by key. Reproduced and fixed in a throwaway container on hunter, 6 Nov 05:35Z. After maybelle's redeploy, the mirror fills within a minute and pushes work.
• ☑
  Confirm jenkins_github_ssh_key can push to the org's repos: after hunter's redeploy, re pushes a branch to hunter and magent reads githouse.log on maybelle for a forward failure

  test · magent

  6 Nov 05:42Z: yes. magent pushed magenta:magent/githouse-smoke to maybelle from its container; the branch was on GitHub within seconds and in hunter's mirror within a minute.
• ☑
  Merge magenta#408 (PR cards look at GitHub hourly), then redeploy maybelle

  merge · justin

  Merged 04:57Z and live (magenta at 3a57cb2a).
• ☑
  Set each repo's GitHub default branch to the branch that deploys

  infra · justin

  Dropped, Justin 6 Nov 11:22Z: main stays the default, the branch where history is final; the deploy branch stays per-repo config (#376). The mains catch up to the productions after the ramp settles: arthel and maybelle-config are fast-forwards, pickipedia has 2 commits on main not on production, magenta's production is dead (3 commits, Nov 2025).
• ☑
  Rulesets on the branches that deploy (PR required, no force-push, no deletion; admins bypass)

  infra · justin

  Dropped, Justin 6 Nov 11:22Z: no further entrenching GitHub. githouse's check() already refuses any push that isn't <name>/*, so no emergent reaches a deploy branch; at the flip GitHub becomes a mirror we push to, and a ruleset is one more thing to undo. Plan section 5 to be rewritten once item 2 is decided.
• ☑
  Merge magenta#333 (repo:branch autocomplete, reading /api/branches/ from maybelle's githouse copy), then redeploy maybelle

  merge · justin

  Reviewed by re 1 Nov and 6 Nov. Its mount exists on maybelle since the 05:08Z deploy, so it can go now.