Ported from co-op/docs#7 (written by solo.ist). The runbook this patched
moved to this git-only repository, so the inventory belongs here with it.
Every credential the agents and the member-facing apps hold: purpose, where
it lives, who rotates it, and the accounts they come from. Names and roles
only; no secret values.
Applied on landing (the two points raised after the PR's last review):
- OC_PERSONAL_TOKEN: the previous personal token is recorded as revoked
(the operator confirmed on 2026-10-27), not 'should be revoked'.
- Added the LibreChat RAG service key (RAG_OPENAI_API_KEY, gateway alias
rag-service-embeddings), added 2026-10-27.
The write-up has sat on incident/2026-10-02-gateway-cve-upgrade since the
outage and that branch is now far behind main. This lifts just the incident
text and the CVE note into incidents/, attributed to InferenceBot with the
substance unchanged, and links it from infrastructure.md under a new
Incident log section.
solo.ist
