TODO: mark DW dw_admin code-strip DONE (rotation still Steve-gated)

7e7deff46fe246936fd85eef14f62f6621fa1251 · 2026-05-30 23:32:17 -0700 · Steve Abrams

25 source files stripped across Designer-Wallcoverings parent + 2 nested
repos (DW-Programming + shopify), 7 stale .pyc untracked. All dw_admin pw
literals gone from the git tree.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M TODO.md

Diff

commit 7e7deff46fe246936fd85eef14f62f6621fa1251
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 23:32:17 2026 -0700

    TODO: mark DW dw_admin code-strip DONE (rotation still Steve-gated)
    
    25 source files stripped across Designer-Wallcoverings parent + 2 nested
    repos (DW-Programming + shopify), 7 stale .pyc untracked. All dw_admin pw
    literals gone from the git tree.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 TODO.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/TODO.md b/TODO.md
index bbe5fde..5d6cd69 100644
--- a/TODO.md
+++ b/TODO.md
@@ -11,7 +11,7 @@ up unchecked rows automatically.
 - [x] Pulled 8 BAD damask room renders (oversized/micro, misrepresented product) — reversible soft-delete, Steve-approved.
 - [ ] **Room pipeline Phase 2 (gated, when ready):** the room-setting-app Gemini engine still has flat/scale/single-template issues for NEW cloud renders — prompt-harden (no-frame), scale-normalize (analyze-pattern route exists, caller hardcodes 27"), hue→room template. See `~/.claude/yolo-queue/ROOM-PIPELINE-ROOTCAUSE.md`. NOT urgent — the free PIL path covers the catalog.
 - [ ] ~114 true-orphan designs (wallco_rooms row but no file either location) — re-render or DB image_path repair. See `~/.claude/yolo-queue/PARKED-FOR-STEVE.md`.
-- [ ] **Security (Kamatera compromise 2026-05-30):** wallco-ai stripped of hardcoded dw_admin DSN (c07228b8) + security-monitor cron (4d989e2e). REMAINING: ~30 tracked files in `Designer-Wallcoverings/DW-Programming` still have the hardcoded dw_admin DSN password (redacted). REAL fix = rotate dw_admin pw (Steve-gated).
+- [~] **Security (Kamatera compromise 2026-05-30):** wallco-ai stripped of hardcoded dw_admin DSN (c07228b8) + security-monitor cron (4d989e2e). **Designer-Wallcoverings code hygiene DONE 2026-05-30** — 25 source files stripped across nested DW-Programming (3e3124d, 16 files) + nested shopify (0f0a91a, 2 files) + parent (06d3d7a, 7 files), plus 7 stale .pyc untracked via new __pycache__ gitignore rule. All dw_admin pw literals gone from `git grep` (literal redacted from this TODO row to keep gitleaks happy). Patterns covered: bare DSN, export PGPASSWORD, inline PGPASSWORD='..' psql, DB_PASS="..", README.md env-example. Host + DB preserved in every DSN per secret-strip convention. **STILL OPEN (Steve-gated):** rotate the dw_admin pw itself via `~/Projects/_shared/docs/pg-rotation-runbook.md` — once rotated, these scripts inherit the new pw via env without further code changes.
 - [x] SSH auth to Kamatera fixed (rotated key not matched by IP in ~/.ssh/config → added IP to Host block + ssh-add).
 - [x] Auto-resume: canonical daemon `com.steve.claude-auto-resume` (pid 3452) is the real one; global kill-switch `~/.claude-resume-disabled` is ON to stop self-trigger in phrase-quoting sessions (removed my redundant claude-resume-all.sh dup).

← 640981f Tag 895 held banana/palm drunk-animals as legal-review (sett · back to Wallco Ai · luxe-v2 curation triage report (910 candidates, read-only, D 1761ac6 →