← back to Credentials Agentabrams
auto-data-snapshot: 2026-09-23T10:03:20 (1 data files) — data/credentials.json
2c56e4b6b64f5a3f3e1d86a28045d7936a858989 · 2026-09-23 10:03:29 -0700 · auto-commit-fleet
Files touched
Diff
commit 2c56e4b6b64f5a3f3e1d86a28045d7936a858989
Author: auto-commit-fleet <steve@designerwallcoverings.com>
Date: Wed Sep 23 10:03:29 2026 -0700
auto-data-snapshot: 2026-09-23T10:03:20 (1 data files) — data/credentials.json
---
data/credentials.json | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/data/credentials.json b/data/credentials.json
index 9c49589..7c4ddd2 100644
--- a/data/credentials.json
+++ b/data/credentials.json
@@ -19,13 +19,13 @@
"runbook": "~/Projects/_shared/docs/pg-rotation-runbook.md",
"mint_url": null,
"console_steps": "Pick new ≥20-char pw → ALTER ROLE dw_admin WITH PASSWORD on prod Kamatera (sudo -u postgres psql) AND local Mac2 → restart pm2 fleet → fan out.",
- "route_back": "printf 'DW_ADMIN_DB_PASSWORD=<NEW_PW>' | node ~/Projects/secrets-manager/cli.js import-paste",
+ "route_back": "NOT a `secrets add` key — dw_admin is embedded inline inside DATABASE_URL across ~40 pm2 apps + ~80 scripts (found by grepping for the OLD PASSWORD VALUE, not a var name). The runbook's own Step 2 script does the fan-out (search-and-replace across every .env). DW_ADMIN_DB_PASSWORD is unregistered in routes.json BY DESIGN — registering it generically would not correctly rewrite all those embedded DSNs. Follow the runbook exactly.",
"verify": "node ~/Projects/secrets-manager/cli.js check",
"why": "dw_admin is the shared admin used by wallco, the DW fleet, Norma sdcc, etc. Stays compromised until this runs. ~32 min operation covering local + Kamatera."
},
{
"id": "gemini-key-1",
- "title": "Gemini API key #1",
+ "title": "Gemini API key #1 (Patty)",
"priority": "P2",
"status": "OUTSTANDING",
"class": "console-mint",
@@ -34,13 +34,13 @@
"runbook": null,
"mint_url": "https://aistudio.google.com/apikey",
"console_steps": "Create new key, DELETE the old one in the same console.",
- "route_back": "printf 'GEMINI_API_KEY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste",
+ "route_back": "printf 'GEMINI_API_KEY_PATTY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste (registered 2026-09-23 → fans to ~/Projects/Patty/.env.local as GEMINI_API_KEY)",
"verify": "node ~/Projects/secrets-manager/cli.js check (hits Gemini /models)",
- "why": "Exposed key on-disk; rotate + delete old."
+ "why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach Patty) — fixed 2026-09-23."
},
{
"id": "gemini-key-2",
- "title": "Gemini API key #2",
+ "title": "Gemini API key #2 (PoppyPetitions)",
"priority": "P2",
"status": "OUTSTANDING",
"class": "console-mint",
@@ -48,10 +48,10 @@
"exposed": "Hardcoded in PoppyPetitions/lib/gemini.ts.",
"runbook": null,
"mint_url": "https://aistudio.google.com/apikey",
- "console_steps": "New key, delete old. Confirm the route name in routes.json (GEMINI_API_KEY_RALPH or poppy-specific).",
- "route_back": "printf '<KEY_NAME>=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste",
+ "console_steps": "Create new key, DELETE the old one in the same console.",
+ "route_back": "printf 'GEMINI_API_KEY_POPPY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste (registered 2026-09-23 → fans to ~/Projects/PoppyPetitions/.env.local as GEMINI_API_KEY)",
"verify": "node ~/Projects/secrets-manager/cli.js check",
- "why": "Exposed key on-disk; rotate + delete old."
+ "why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach PoppyPetitions) — fixed 2026-09-23."
},
{
"id": "repl-user-pg-pw",
← fca2e63 group credential dashboard: action-needed on top, green conn
·
back to Credentials Agentabrams
·
correct Gemini routing (new dedicated keys) + flag PG passwo 3c55eac →