correct Gemini routing (new dedicated keys) + flag PG passwords as non-routable (runbook-only)

3c55eacd13a0a9fbc4958456c6f58a7c6d023172 · 2026-09-23 10:03:39 -0700 · Steve Abrams

Files touched

M data/credentials.json

Diff

commit 3c55eacd13a0a9fbc4958456c6f58a7c6d023172
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 23 10:03:39 2026 -0700

    correct Gemini routing (new dedicated keys) + flag PG passwords as non-routable (runbook-only)
---
 data/credentials.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/credentials.json b/data/credentials.json
index 7c4ddd2..91dcd2d 100644
--- a/data/credentials.json
+++ b/data/credentials.json
@@ -64,7 +64,7 @@
       "runbook": "~/cncp-starter/yolo-queue/pending-approval/mirror-resync-FIX.md",
       "mint_url": null,
       "console_steps": "On Kamatera publisher: ALTER ROLE repl_user WITH PASSWORD; clear stray legacy table from publication dw_unified_pub.",
-      "route_back": "printf 'REPL_USER_DB_PASSWORD=<NEW_PW>' | node ~/Projects/secrets-manager/cli.js import-paste",
+      "route_back": "NOT a `secrets add` key — the new password is passed directly as an env var to the resync script (see verify), not fanned to any .env file. REPL_USER_DB_PASSWORD is intentionally unregistered in routes.json.",
       "verify": "REPL_PW=<NEW_PW> bash ~/cncp-starter/yolo-queue/run-mirror-resync.sh — max(synced_at) jumps to now",
       "why": "Unblocks the frozen dw_unified mirror (Vendors/edges/settlement panels)."
     },

← 2c56e4b auto-data-snapshot: 2026-09-23T10:03:20 (1 data files) — dat · back to Credentials Agentabrams · TK-12268: add creds-in-URL fetch guard (fleet pattern) to ga 90c4c26 →