From 95c62585948df27fae1bb78e7292295fb331bf0d Mon Sep 17 00:00:00 2001 From: InferenceBot Date: Wed, 28 Oct 2026 14:19:37 +0000 Subject: [PATCH] runbook: how to confirm the webhook URL match, and what the watch job does and does not cover --- operator-token-runbook.md | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/operator-token-runbook.md b/operator-token-runbook.md index 0f86287..d8e29f5 100644 --- a/operator-token-runbook.md +++ b/operator-token-runbook.md @@ -65,10 +65,22 @@ cutover completed 2026-10-28 (`ADMIN_TOKEN_LEGACY=0`), verified on the wire: webhook URL configured on the collective, which needs Open Collective admin access — the same blocker as moving `OC_PERSONAL_TOKEN` (below) to a co-op-owned account. -- **Unverified:** whether the collective's webhook URL was updated in step with - that rotation. The route compares the URL token against the env var, so a - mismatch makes OC's deliveries 401 and new-member provisioning waits for the - nightly sweep (delayed, not lost). Treat the first real OC event as the test. +- **Whether the collective's webhook URL matches the current token is still + unconfirmed** (as of 2026-10-28). The route compares the URL token against the + env var, so a mismatch means OC's deliveries 401 and new-member provisioning + waits for the nightly sweep — delayed, not lost. +- **To confirm it directly**, compare by hash rather than by reading the value + out: take the URL's last path segment in the collective's webhook settings and + run `printf %s '' | sha256sum` LOCALLY, then compare its first 12 hex + characters against the same prefix of the portal's `WEBHOOK_TOKEN`. A hash + prefix of a live secret does not belong in this file or in chat. +- **The monitor already covers the failure case.** The `portal webhook delivery + watch` cron job alerts on ANY failed delivery (401/404 = OC is posting to a URL + the portal rejects) and stays silent on the happy path, which is why silence in + its output means "nothing to report" and not "blind". Verified 2026-10-28 by + posting a benign event with the current token: the portal answered 200 and the + job reported it with `--verbose`. Run it with `--verbose` to see accepted + deliveries; run it plainly to see only problems. - **No caller may fall back from `ADMIN_TOKEN` to `WEBHOOK_TOKEN`.** The legacy token 403s, so a fallback turns "unset" into a confusing mid-run failure instead of a clear abort.