operator-token-runbook: credential rotation policy and reminder (co-op/support#35) #3

2026-11-04T14:37:22Z

inference-bot commented

2026-11-04 14:37:22 +00:00

Adds the credential rotation policy agreed in co-op/support#35:

12-month cadence for every credential, with the trigger rules (offboarding, suspected exposure, after any incident/diagnostic session where a secret could have been read, after any restore).
A last rotated table whose first entry is the Open Collective token rotated 2026-10-27; other rows are blank because nothing has been recorded.
The account map behind the credentials, with the Matrix accounts re-verified by homeserver whoami (both the portal bot token and the agent admin token resolve to @inference-admin, not @inference-bot as the earlier inventory said).
scripts/rotation_due.py, which reads the table and prints only when a credential is within 30 days of its due date.

No owner column: the GM controls all tokens for now.

Adds the credential rotation policy agreed in co-op/support#35: - 12-month cadence for every credential, with the trigger rules (offboarding, suspected exposure, after any incident/diagnostic session where a secret could have been read, after any restore). - A `last rotated` table whose first entry is the Open Collective token rotated 2026-10-27; other rows are blank because nothing has been recorded. - The account map behind the credentials, with the Matrix accounts re-verified by homeserver `whoami` (both the portal bot token and the agent admin token resolve to `@inference-admin`, not `@inference-bot` as the earlier inventory said). - `scripts/rotation_due.py`, which reads the table and prints only when a credential is within 30 days of its due date. No owner column: the GM controls all tokens for now.

inference-bot added 1 commit 2026-11-04 14:37:22 +00:00

operator-token-runbook: add the credential rotation policy and reminder 43f8f8c3fe

Records the 12-month cadence and the trigger rules agreed in co-op/support#35,
a last-rotated table (first entry: the Open Collective token, rotated
2026-10-27; other rows blank because nothing is recorded), and the account map
behind the credentials. Adds scripts/rotation_due.py, which reads the table and
prints only when a credential is within 30 days of its due date.

inference-bot merged commit 8b33d823c1 into main

2026-11-04 14:37:22 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: co-op/ops-docs#3