Audit of the operator docs against live reality (2026-11-04):
- app-inventory.md: all 19 Cloudron apps with id, fqdn and registry image pin.
Corrects the portal path (code/member-portal, not co-op/member-portal) and the
panel path (local/coop.inference.admin-panel, not code/admin-panel).
- maintenance/backups.md: the two backup systems; the deliberate per-user restic
cache split and the --group-by "" retention fix, with why.
- maintenance/woodpecker-ci.md: CI server + agent, image build/pin, manual-only
trigger, git-lfs requirement, and its current not-yet-green state (agent's
job-collection long-poll gets HTTP 500 from the server).
- provider-pricing/: index + GreenPT, Tinfoil (local EHBP proxy architecture) and
the Metis /v1/systemone decision-model route; regolo.md updated to record the
gateway prices were applied.
- agent-fleet.md: steward, infrastructure-bot and socialbot (Unix users, gateway
units, teams); member-bot tier 2 planned but not yet provisioned.
- README: file list; operator-token-runbook: correct the membership_sweep cadence
(3x daily, not nightly); migration doc: post-migration addendum (16->19 apps,
DNS split resolved, old box still on with apps stopped).
Records the 12-month cadence and the trigger rules agreed in co-op/support#35,
a last-rotated table (first entry: the Open Collective token, rotated
2026-10-27; other rows blank because nothing is recorded), and the account map
behind the credentials. Adds scripts/rotation_due.py, which reads the table and
prints only when a credential is within 30 days of its due date.
Ported from co-op/docs#7 (written by solo.ist). The runbook this patched
moved to this git-only repository, so the inventory belongs here with it.
Every credential the agents and the member-facing apps hold: purpose, where
it lives, who rotates it, and the accounts they come from. Names and roles
only; no secret values.
Applied on landing (the two points raised after the PR's last review):
- OC_PERSONAL_TOKEN: the previous personal token is recorded as revoked
(the operator confirmed on 2026-10-27), not 'should be revoked'.
- Added the LibreChat RAG service key (RAG_OPENAI_API_KEY, gateway alias
rag-service-embeddings), added 2026-10-27.
inference-bot
solo.ist