A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I0918
The bootstrap credential is used once and belongs to nothing
Where it stands
devtask.issue- Readiness
- cancelled withdrawn
- Status
- CANCELLED
- Can start
- not now
- Milestone
- Milestone status
- ACTIVE
- Wave
2- Waiting on
- none
- Holds back
- Behind it in all
3- Evidence
0of3
Moves
plan.transitionWhat it is
- Objective
- Define and implement how a deployment credential is discovered for an interactive first deployment, so that it is consumed in one process, never persisted, and leaves no trace of where it came from.
- Why
- The credential that makes the first deployment possible comes from an environment outside this repository. If any part of that path reaches the source, the scripts, the documentation, the CI or a default, Majordomus acquires a dependency on another repository, which is forbidden.
- Now
- No deployment exists and no credential handling exists. A usable credential is expected to be reachable through the operator's existing authenticated tooling.
- Wanted
- A documented discovery order finds an existing authenticated session, the token is consumed only in the current process, and no file in this repository names the external environment it came from.
- Done when
- Cancelled 2026-10-14 on master e28daccd9b: it is about how a Fly bootstrap token is found; publishing to GHCR uses the workflow's own GITHUB_TOKEN. The owner disconnected Fly.io on 2026-10-12; this repository deploys release binaries, the GHCR image and GitHub Pages (commit 9af3fa65a4 removed fly.toml).
- Risk
- A convenience that reads the operator's other environment is exactly the dependency this issue exists to prevent. Bootstrap happens in a person's shell, not in this repository's code.
Acceptance
- The discovery order is documented and implemented — an existing environment variable, then an already authenticated provider CLI, and nothing that reads another repository
- Credential validity is confirmed with a command that returns an identity and never a secret
- No token value can be printed by any code path, including verbose output, error messages and traces
- A check proves no path belonging to another repository appears anywhere in this one
- Deployment credentials and application runtime secrets are treated as distinct concepts, and the distinction is documented
- Validation
bash test/run.shcargo test --workspace --all-features- Evidence required
discovery_orderno_persisted_tokenno_platform_dependency- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
docs/DEPLOYMENT-SECURITY.mdapps/majordomus-cli/src/deploy/credentials.rs- Not
Any reference, in code, script, documentation, CI, test, default or generated artifact, to another repository's path or environmentWriting a token to any file in this repositoryPassing a token as a build argument or baking it into an image layer- Depends on
- Priority
- p0
- Profile
- deep-work
- Parallel safe
- true
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-06
- Updated
- 2026-10-14
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
Nothing is wrong with these records.