docs(token-rotation): record mint dates and the private-repo carve-out - #86
Merged
Merged
Conversation
The table shipped empty. Fill it from `gh secret list` timestamps, which give the date each secret's value was last set -- enough to plan a rotation against. Expiry stays blank on purpose. It is not readable from the API; it exists only in what `claude setup-token` printed at mint time. Say so in the doc rather than leaving three empty cells that look like an oversight, since a row without a real expiry cannot get its calendar reminder either. Two rows are new. photo-game-poc and cleanroom are private repos running Claude workflows, so they carry repo-level copies for the same reason scripts does; the doc previously named only scripts. Both orgs currently read as plan=team, under which an org secret would reach a private repo and make these copies redundant. That plan was bought to file a support ticket and is temporary, so the doc warns against deleting a private repo's token on the strength of it -- the failure would land at the downgrade, silently, on repos nobody is watching. Claude-Session: https://claude.ai/code/session_01MM2jf6c7eNN4QMq32GdC5X
twistedmelonman
deleted the
claude/docs-step6-token-rotation-1ef43e2a
branch
September 4, 2026 22:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 6 of the org migration: the token-rotation doc shipped with an empty
table, and its private-repo rationale named only one repo.
What changed
Mint dates filled in, from each secret's
updated_atviagh secret list— the date the value was last set, which is what rotation planningneeds.
Expiry left blank, and the doc now says why. It is not readable from
the API; it exists only in what
claude setup-tokenprinted at mint time.Three empty cells otherwise read as an oversight, and a row without a real
expiry cannot get its calendar reminder either — so the blank is load-
bearing information, not a gap.
Two rows added.
photo-game-pocandcleanroomare private reposrunning Claude workflows, so they carry repo-level tokens for exactly the
reason
scriptsdoes. The doc named onlyscripts.A warning about the temporary Team plan. Both orgs currently read as
plan=team, under which an org secret does reach private repos, whichwould make all three repo-level copies look redundant. That plan was bought
to file a support ticket and will be dropped. Deleting a private repo's
token on the strength of it fails at the downgrade — silently, on repos
nobody is watching.
Verification
org-owned
smartwatermelon/dev-envRelated
Filed alongside this: #85, the
scripts-goes-public issue Step 6 calls for.Remaining in Step 6: the calendar events (needs real expiry dates first)
and removing the wrapper's
smartwatermelonlogin alias — the lattergated on TILSIT and MIMOLETTE running runbook Part D, or
ghbreaks onboth machines.
https://claude.ai/code/session_01MM2jf6c7eNN4QMq32GdC5X