Reconcile ROTATION-CHECKLIST against 2026-06-21 read-only verification: dw_admin item #1 still genuinely OUTSTANDING (old pw live in 4 DSNs, canonical fan key unset); Shopify item #4 was STALE -> RESOLVED (token HTTP 200). DTD verdict A unanimous: compromised flag stays.

7fe7f4ef156cfb0d8b0e3caa6eb0029c2af74155 · 2026-06-21 09:03:49 -0700 · SteveStudio2

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

M ROTATION-CHECKLIST.md

Diff

commit 7fe7f4ef156cfb0d8b0e3caa6eb0029c2af74155
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Sun Jun 21 09:03:49 2026 -0700

    Reconcile ROTATION-CHECKLIST against 2026-06-21 read-only verification: dw_admin item #1 still genuinely OUTSTANDING (old pw live in 4 DSNs, canonical fan key unset); Shopify item #4 was STALE -> RESOLVED (token HTTP 200). DTD verdict A unanimous: compromised flag stays.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 ROTATION-CHECKLIST.md | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/ROTATION-CHECKLIST.md b/ROTATION-CHECKLIST.md
index 62febca..1d1f87a 100644
--- a/ROTATION-CHECKLIST.md
+++ b/ROTATION-CHECKLIST.md
@@ -10,6 +10,22 @@
 
 ## 1. PG `dw_admin` password  ⬜ OUTSTANDING  (P1 — the actual compromise fix)
 
+> **Re-verified 2026-06-21 (read-only): STILL GENUINELY OUTSTANDING — not stale.**
+> Proof the rotation never landed: the old leaked plaintext `DW2024SecurePass`
+> is still live in all 4 local consumer `.env.local` DATABASE_URL DSNs
+> (Norma/sdcc, StudentLoanTracker/dw_unified, ClawCoder/clawcoder,
+> ImportNewSkufromURL/dw_unified — all 127.0.0.1) and those apps connect
+> cleanly → the local Mac2 `dw_admin` role STILL uses the compromised pw.
+> The canonical fan key `PG_DW_ADMIN_PASSWORD` has **zero value** in the secrets
+> registry (only the two dead aliases `DW_ADMIN_PG_PASSWORD` fWdg:1e3383c0 +
+> `DW_ADMIN_DB_PASSWORD` 22WF:7397bbbe carry digests — master+desktop only,
+> never fanned). `routes.json` now carries `PG_DW_ADMIN_PASSWORD` scaffolding
+> (4 env_file dests) — **prep done, but no secret behind it; cli.js has never
+> fanned dw_admin.** Prod role pw is SCRAM/unreadable; no evidence prod rotated.
+> → The CNCP compromised flag (cncp server.js `out.prod.status:'compromised'`)
+> stays SET. DTD 2026-06-21 verdict A, unanimous 3/3. Execute via
+> `DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh` (Steve-run, step-gated).
+
 - **Exposed:** literal value was hardcoded in 14+ files on disk (scrubbed locally), and lives in Time Machine snapshots / Spotlight index / possibly remote git history.
 - **Runbook:** `~/Projects/_shared/docs/pg-rotation-runbook.md` (~32 min, includes the Kamatera mirror — prod + local both).
 - **Why it's the big one:** `dw_admin` is the shared admin used by wallco, the DW fleet, Norma's sdcc, etc. The Norma scoped rotation below does **not** fix this — it only moves Norma *off* `dw_admin`. `dw_admin` itself stays compromised until this runs.
@@ -62,9 +78,19 @@ Pre-flight (read-only, 2026-06-01) confirmed safe to run:
 
 ## Newly identified (2026-06-03)
 
-## 4. `SHOPIFY_ADMIN_TOKEN`  ⬜ OUTSTANDING  (P1 — blocks DW catalog→Shopify push)
+## 4. `SHOPIFY_ADMIN_TOKEN`  ✅ RESOLVED  (re-verified 2026-06-21 — was STALE)
+
+> **Reconciled 2026-06-21 (read-only): this item was STALE — the token WORKS.**
+> `SHOPIFY_ADMIN_TOKEN` (last4 `75b9`, registry digest `75b9:95b01e9b`) returns
+> **HTTP 200** against `/admin/api/2024-04/shop.json`, and products were created
+> with it this session. The "undefined / burned / no push since Apr 30" text
+> below was the 2026-06-03 snapshot and no longer holds. NOTE: a working Shopify
+> token is a **separate credential** and says nothing about the `dw_admin`
+> compromise (item #1) — it does NOT justify clearing the compromised flag.
+> (Any residual "no push" symptom is an env-sourcing/cron-wiring issue per the
+> full-monte notes, not a dead token.)
 
-- **Exposed / status:** likely the burned post-bubbe token. The full-monte Phase 8 catalog push reads `process.env.SHOPIFY_ADMIN_TOKEN` and currently gets `undefined` → every push auth-fails silently (catch-up "succeeded" counts are error-caught lies, 0 real writes). DW catalog has not pushed to Shopify since ~Apr 30.
+- **(historical, 2026-06-03 — superseded by the note above)** likely the burned post-bubbe token. The full-monte Phase 8 catalog push reads `process.env.SHOPIFY_ADMIN_TOKEN` and currently gets `undefined` → every push auth-fails silently (catch-up "succeeded" counts are error-caught lies, 0 real writes). DW catalog has not pushed to Shopify since ~Apr 30.
 - **Mint:** Shopify admin → Apps → (custom app) → API credentials → revoke old Admin API access token, install/reveal a new one.
 - **Secret key name:** `SHOPIFY_ADMIN_TOKEN` (confirm against `routes.json`).
 - **Route back:**

← 2297149 secrets: add PG_DW_ADMIN_PASSWORD fan route (4 env_file dest · back to Secrets Manager · auto-save: 2026-06-21T18:53:00 (7 files) — .gitignore regist 74dfa62 →