I0918 — The bootstrap credential is used once and belongs to nothing

!CANCELLED wave 2 · p0 · deep-work profile · parallel safe

Part of fly-deployment — The container image is a projection of the repository model, and its smoke is its evidence.

Objective

Define and implement how a deployment credential is discovered for an interactive first deployment, so that it is consumed in one process, never persisted, and leaves no trace of where it came from.

Why

The credential that makes the first deployment possible comes from an environment outside this repository. If any part of that path reaches the source, the scripts, the documentation, the CI or a default, Majordomus acquires a dependency on another repository, which is forbidden.

Current state

No deployment exists and no credential handling exists. A usable credential is expected to be reachable through the operator's existing authenticated tooling.

Desired state

A documented discovery order finds an existing authenticated session, the token is consumed only in the current process, and no file in this repository names the external environment it came from.

Scope

• docs/DEPLOYMENT-SECURITY.md
• apps/majordomus-cli/src/deploy/credentials.rs

Out of scope

• Any reference, in code, script, documentation, CI, test, default or generated artifact, to another repository's path or environment
• Writing a token to any file in this repository
• Passing a token as a build argument or baking it into an image layer

Dependencies

• I0902✓DONE The deployment object becomes typed Rust that refuses nonsense

What waits on this

• I0929!CANCELLED Production deploys from CI with a token scoped to one application
• I0931!CANCELLED The application exists, one machine runs it, and the URL answers

Acceptance criteria

• The discovery order is documented and implemented — an existing environment variable, then an already authenticated provider CLI, and nothing that reads another repository
• Credential validity is confirmed with a command that returns an identity and never a secret
• No token value can be printed by any code path, including verbose output, error messages and traces
• A check proves no path belonging to another repository appears anywhere in this one
• Deployment credentials and application runtime secrets are treated as distinct concepts, and the distinction is documented

Validation

• bash test/run.sh
• cargo test --workspace --all-features

Evidence required

• discovery_order
• no_persisted_token
• no_platform_dependency

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A convenience that reads the operator's other environment is exactly the dependency this issue exists to prevent. Bootstrap happens in a person's shell, not in this repository's code.

Completion report

Cancelled 2026-10-14 on master e28daccd9b: it is about how a Fly bootstrap token is found; publishing to GHCR uses the workflow's own GITHUB_TOKEN. The owner disconnected Fly.io on 2026-10-12; this repository deploys release binaries, the GHCR image and GitHub Pages (commit 9af3fa65a4 removed fly.toml).

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0918.yaml. Read it back with majordomus plan show I0918.