From fbfca9624ea5a913263b446938a1b130b5410e1b Mon Sep 17 00:00:00 2001
From: Inferencebot <bot@inference.coop>
Date: Thu, 29 Oct 2026 17:45:04 +0000
Subject: [PATCH] infrastructure: say which Matrix account is which, and start
 retiring @inference-bot

Four automated accounts touch the homeserver and two of them differed by one
character, which caused real confusion (a bot appearing to announce itself; the
steward unable to post in a room it had been asked to report to). This records
the distinction rather than leaving it to be rediscovered.

Power belongs to @inference-admin, voice belongs to @inferencebot, and
@inference-admin never speaks in a member room. @inference-bot is being retired:
its room power was transferred to @inference-admin, which is now administrator of
record for #general, #community, #design, #skillshare, #updates and
#infrastructure.

Also records the one live dependency that blocks finishing: the portal's member
invites still authenticate as the old account via MATRIX_BOT_TOKEN, so that has
to be repointed before its credentials are revoked. Without this written down the
next person would revoke the token and silently break member invites.

Verified while writing: the portal's token hashes to the old account's device
VYQDYBXULA, which is also the unexplained python-httpx client seen using that
account today.
---
 infrastructure.md | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/infrastructure.md b/infrastructure.md
index a600286..7b020ee 100644
--- a/infrastructure.md
+++ b/infrastructure.md
@@ -60,8 +60,38 @@ added via the portal's `MATRIX_EXTRA_MXIDS` env.
 
 Federation is enabled (delegated via `.well-known/matrix/server` on the bare
 domain, port 443), so members can also join from any homeserver they already
-use. The `@inference-bot:inference.coop` admin account (used by the portal
-for invites) has no password — token lives in the portal env.
+use.
+
+### Which account is which
+
+Several automated accounts touch this homeserver, and two of them once differed
+by a single character — which caused real confusion, including a bot appearing to
+announce itself. The distinction is deliberate:
+
+- **`@inferencebot:inference.coop` — the steward.** The bot members actually meet:
+  it posts digests, newsletter notes and reminders. It is *not* a Synapse server
+  admin, and holds no room power beyond what it needs to post.
+- **`@inference-admin:inference.coop` — the room and server administrator.** A
+  Synapse server admin, used for provisioning rooms, managing membership, and
+  retiring rooms. It **never speaks in a member room**; a message from it is a
+  mistake, not a feature.
+- **`@infrastructure-bot:inference.coop` — the infrastructure working group's bot.**
+  Answers infrastructure questions in **#infrastructure** when mentioned.
+- **`@ops_audit:inference.coop`** — a server-admin account created for the October
+  2026 security review. Retained only until its tokens are revoked.
+
+**House rule: power belongs to `@inference-admin`, voice belongs to `@inferencebot`.**
+Please don't create another account whose name differs from an existing one by a
+character or two; that is the specific confusion this section exists to undo.
+
+**`@inference-bot:inference.coop` is being retired.** It was the original
+room-administration account (it created the space and most of the rooms) and it
+held a Synapse server-admin flag. Its room power was transferred to
+`@inference-admin`, which is now the administrator of record for #general,
+#community, #design, #skillshare, #updates and #infrastructure. Until the
+retirement finishes, one live dependency remains: the portal's member invites
+(`MATRIX_BOT_TOKEN`) still authenticate as the old account, so that must be
+repointed before its credentials are revoked.
 
 ## How the apps run themselves