sorb's call: rotate everything once at acceptance rather than piecemeal now.
That is the lower-risk order — the mirror credential is still unidentifiable and
the mirrors feed the Flux source, so four separate revocations would mean four
separate ways to break it silently. The inventory and the ordering stay valid, so
the later rotation is execution rather than analysis.
Recorded what the deferral accepts rather than leaving it implicit: the exposed
WireGuard key and PATs stay valid, five never-used tokens remain (one with
manage_runner and k8s), and 'acceptance' is not a dated milestone — which is
exactly how security work rots. The existing due date stays as a review anchor,
not a rotation deadline.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Inventoried the 24 git.lab PATs by metadata only — last_used_at separates
'needed' from 'lying around': four are in active use, five are active but never
used at all (one with manage_runner and k8s scope), and several names exist twice
because a replacement was created without revoking the old one. All six push
mirrors are healthy, but GitLab masks both parts of the mirror URL, so the
credential remains unidentifiable — and it is a Gitea token, which the PAT list
cannot answer for. Hence the ordering: set a dedicated mirror credential first,
revoke second. The revocations themselves are sorb's; from here a never-used
token is indistinguishable from a staged one.
W5 resolved: the secrets rule now has a bootstrap exception, since on a headless
host it was only satisfiable by violating it. W4 splits — point 5 is #0015 (plus
the WG key, which no token inventory covers), point 4 is demonstrably undone.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Gate 4, slice 4: 26 open management issues imported from live git.lab
(read-only, descriptions included as authorized; GitLab iid = file id,
labels/milestone/priority/due/host/area mapped into frontmatter, the
import aborts instead of inventing a missing milestone or priority).
Two new issues close the F-004 gap where work was really still open
(0033 OVERMIND-01, 0034 CFGMON-11 incl. the plaintext npm-token
rotation); CFGMON-12/13 already route to verified git.lab issues,
MATRIX-05 is done and needs none (agreed with sorb). The three wiki
task blocks now reference their issues, roadmap.md hands all counts to
the generated STATUS.md and states M1-M5 per ADR-0010 (closing F-001
in the canonical prose), pruefe_prosa joins the CI validate job, and
the import protocol under docs/sources/migration/ records every
intervention into imported text.
Verified: validate 0/0 over 29 issue files, gen_status --check current
(distribution line M1 9 - M2 17 - M4 2 plus per-issue milestone and
priority), pruefe_prosa 0 errors with clones and 0 errors/15 unchecked
citations in offline CI mode, drift check green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 4.8