Cryptograss:Moods/security/todo
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
- ☐Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)Moved from #ops. The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config.
- ☐Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki passwordMoved from #ops. workbench runs as user magent; anyone there pushes as magent-cryptograss and edits as Magent. Tell skyler, rj and fibonacci before it lands.
- ☐Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)Moved from #ops. Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person.
- ☐The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without oneMoved from #ops. Columns: secret, destination, consumer, why, deploy-time or runtime. re's skeleton: #ops, 2 Nov 11:45Z. Each row carries the task's when: text. Completeness needs one read of the vault's key list by the password-holder.
- ☐NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if sossh.nyc1.nearlyfreespeech.net offers publickey, password, keyboard-interactive. It's their sshd, so the change is an account setting, not something in maybelle-config. maybelle's backups and builds reach it by key.
Done (2)
- ☑Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunterMoved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet.
- ☑Review and merge maybelle-config#278 (SSH by key only), then redeploy hunter, maybelle, pickipedia and delivery-kidmaybelle, pickipedia and delivery-kid offer password SSH today (magent's probe, block 26,349,412). After the deploy, re-probe: each should offer publickey only.