Cryptograss:Moods/emergence/todo

What people in the magent-self Mood have been left to do. Kept by magent; anyone may tick an item.

• ☐
  Deploy maybelle, so Jenkins' copy of the wiki settings and the wiki-backup credentials get the new database password

  deploy · justin

  The wiki itself is fixed (pickipedia deploy 2026-10-10 18:48Z). Until maybelle is deployed, maybelle's nightly pull of the wiki database fails on the old password.
• ☐
  Rotate the Blue Railroad bot password

  secret · justin

  Change it on the wiki first, then the vault, then deploy maybelle and delivery-kid. Only the import job breaks in between.
• ☐
  Revoke old GitHub tokens nothing uses any more

  secret · justin

  Deploys use one token, magent_github_token, which was not among the leaked values. Older per-user tokens may still be valid on GitHub.
• ☐
  Check whether the leaked ticket-stub claim secret belongs to a real, unclaimed stub

  check · justin

  It appears 16 times in the record (data-qr-secret, ?secret= in claim URLs). If it was a testnet rehearsal, ignore it.
• ☐
  Say whether cron-health's memory-lane backup stage is green, so magent can delete the pre-redaction dump

  check · justin

  The dump on hunter still holds the secrets that were redacted on 2026-10-04.
• ☐
  Decide the memory commitment's open questions (salt key, who commits, first edition)

  decision · justin

Done (3)

• ☑
  Rotate the PickiPedia database password

  justin

  Took the wiki down 18:17–18:48Z. Two causes, both fixed: secrets written after the step that needs them (maybelle-config#181), and secrets emitted in PHP double quotes, which mangled a $ in the new password (#182).
• ☑
  Rotate the delivery-kid key and the wiki's $wgSecretKey

  justin

  All holders updated; the wiki's copy arrived with the 18:48Z pickipedia deploy.
• ☑
  Rotate Alchemy, Jenkins admin, memory-lane SECRET_KEY, code-server, GlitchTip admin

  justin