Cryptograss:Moods/security/todo

• ☐
  Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunter

  merge · justin

  Moved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet.
• ☐
  Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)

  infra · justin

  Moved from #ops. The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config.
• ☐
  Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki password

  decision · justin

  Moved from #ops. workbench runs as user magent; anyone there pushes as magent-cryptograss and edits as Magent. Tell skyler, rj and fibonacci before it lands.
• ☐
  Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)

  code · magent

  Moved from #ops. Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person.
• ☐
  The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without one

  code · magent

  Moved from #ops. Columns: secret, destination, consumer, why, deploy-time or runtime. re's skeleton: #ops, 2 Nov 11:45Z. Each row carries the task's when: text. Completeness needs one read of the vault's key list by the password-holder.