Cryptograss:Moods/emergence/todo: Difference between revisions
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
Staging dropped; podcast import handed to pickipedia-and-rabbithole; ticket stubs now blox-office#11 (via update-page on MediaWiki MCP Server) |
Final redaction review: two live credentials were in the record before 10-04; add their rotations (via update-page on MediaWiki MCP Server) |
||
| Line 2: | Line 2: | ||
<todo> | <todo> | ||
- task: "Regenerate magent-cryptograss's GitHub token, put it in the vault as magent_github_token, deploy hunter" | |||
who: justin | |||
kind: deploy | |||
note: "Final redaction review, 2026-10-10: the live token was in the record from 2026-08-30 until the 10-04 redaction (message 5e2ce98f). magent's 10-04 'already safe' check was wrong. Regenerate keeps the scopes; give it an expiry while there." | |||
- task: "Reset the Magent@magent bot password on PickiPedia, put it in the vault as PICKIPEDIA_BOT_PASSWORD, deploy hunter" | |||
who: justin | |||
kind: deploy | |||
note: "Same finding: the live bot password was in the record from 2026-09-15 until 10-04 (message 147af8df). Reset at Special:BotPasswords, logged in as Magent." | |||
- task: "Honour the paper ticket stubs already sold (Porcupine 2025, Bundy show 2026-06-05): inventory, deploy, register secrets" | - task: "Honour the paper ticket stubs already sold (Porcupine 2025, Bundy show 2026-06-05): inventory, deploy, register secrets" | ||
who: justin | who: justin | ||
| Line 28: | Line 36: | ||
who: magent | who: magent | ||
done: 2026-10-10 | done: 2026-10-10 | ||
note: "maybelle's daily/ folder and its offsite mirror still hold pre-redaction dailies (2026-10-02 to 10-04); by the deployed retention they age out by the 10-13 04:00 sync." | |||
- task: "Revoke old GitHub tokens" | - task: "Revoke old GitHub tokens" | ||
who: justin | who: justin | ||
done: 2026-10-10 | done: 2026-10-10 | ||
note: "One token on magent-cryptograss, matching the one in use (classic, no expiry, nine scopes) | note: "One token on magent-cryptograss, matching the one in use (classic, no expiry, nine scopes)." | ||
- task: "Deploy maybelle after the database password rotation" | - task: "Deploy maybelle after the database password rotation" | ||
who: justin | who: justin | ||
Revision as of 20:17, 10 October 2026
What people in the magent-self Mood have been left to do. Kept by magent; anyone may tick an item.
- ☐Regenerate magent-cryptograss's GitHub token, put it in the vault as magent_github_token, deploy hunterFinal redaction review, 2026-10-10: the live token was in the record from 2026-08-30 until the 10-04 redaction (message 5e2ce98f). magent's 10-04 'already safe' check was wrong. Regenerate keeps the scopes; give it an expiry while there.
- ☐Reset the Magent@magent bot password on PickiPedia, put it in the vault as PICKIPEDIA_BOT_PASSWORD, deploy hunterSame finding: the live bot password was in the record from 2026-09-15 until 10-04 (message 147af8df). Reset at Special:BotPasswords, logged in as Magent.
- ☐Honour the paper ticket stubs already sold (Porcupine 2025, Bundy show 2026-06-05): inventory, deploy, register secretsNo claim contract has ever been deployed; the site still points at a placeholder. Mark Hansen bought at least one 2025 stub. Token 1's 2025 secret may be public.
- ☐
- ☐Look at why the nightly podcast import wants to change 240 pages, then release it or fix itHanded off to pickipedia-and-rabbithole on 2026-10-10. Held by its change budget (limit 50); re-run with --max-changes 240 if the changes are intended.
Done (9)
- ☑Drop the pre-redaction staging database on hunter (magenta-staging-pg)Container and its volume removed at Justin's yes.
- ☑Merge maybelle-config#183 and deploy maybelle, so cron-health compiles againBuild 48100 ran every stage for the first time since 4 September.
- ☑Delete the pre-redaction dumps on huntermaybelle's daily/ folder and its offsite mirror still hold pre-redaction dailies (2026-10-02 to 10-04); by the deployed retention they age out by the 10-13 04:00 sync.
- ☑Revoke old GitHub tokensOne token on magent-cryptograss, matching the one in use (classic, no expiry, nine scopes).
- ☑Deploy maybelle after the database password rotation
- ☑Rotate the Blue Railroad bot password
- ☑Rotate the PickiPedia database passwordTook the wiki down 18:17–18:48Z. Two causes, both fixed: secrets written after the step that needs them (maybelle-config#181), and secrets emitted in PHP double quotes, which mangled a $ in the new password (#182).
- ☑Rotate the delivery-kid key and the wiki's $wgSecretKey
- ☑Rotate Alchemy, Jenkins admin, memory-lane SECRET_KEY, code-server, GlitchTip admin