Promote main to release: NASA retirement #74

Merged

admin_emi merged 7 commits from main into release 2026-07-24 23:59:27 +00:00

Conversation 0 Commits 7 Files changed 21 +522 -179

admin_emi commented 2026-07-24 23:59:13 +00:00

Owner

Copy link

Prod serves ERA5-family sources only.

Prod serves ERA5-family sources only.

admin_emi added 7 commits 2026-07-24 23:59:14 +00:00

key-gaps: the key regex was blind to digits, inventing missing secrets ... 7ed375f32e

`grep -oE "^[A-Z_]+="` cannot match a key name containing a digit. This estate
has exactly six such names — all the *_S3_* keys — so a prod audit returned 26
keys against 32 real ones, and reported the S3 and lake credentials as missing
from both live hosts.

They were present the whole time. The phantom was independently reproduced
twice by re-running the same pattern, which is what made it convincing, and it
was briefly recorded as one of two root causes of the lake being unqueryable
(#56). That issue has one cause: the missing duckdb-lake image.

An audit that under-reports is worse than no audit. A missing-secret finding
sends someone to provision a credential that already exists, and in a rotation
tool it would justify writing over one.

Fixed to `^[A-Z][A-Z0-9_]*=` in both the skill and key_gaps.py's docstring. The
match still stops at the `=`, so no value is read — that property is the reason
this grep exists rather than a parser.

Centralis's secrets_gaps carried the same bug and is fixed separately, with a
regression test.

Claude-Session: https://claude.ai/code/session_0182KTMrsTHJc3TcewCatJFY

Drop accidentally-committed worktrees; ignore .claude/worktrees ... f4313b5d87

The previous commit swept in .claude/worktrees/city-resolver and
.claude/worktrees/thermograph-mentions as embedded git repositories. Those are
other Claude sessions' live checkouts and have no business in this tree.

Ignoring the directory so `git add -A` cannot do it again — the repo already
has a documented history of parallel sessions colliding through shared
checkouts, and this is the same hazard wearing a different hat.

Claude-Session: https://claude.ai/code/session_0182KTMrsTHJc3TcewCatJFY

Merge pull request 'key-gaps: the key regex was blind to digits, inventing missing secrets' (#69) from fix/key-gaps-digit-regex into dev 1c763a61c5

Frontend QA batch: date/TZ, https origin, date-422, VAPID rotation, trace-precip, partial-day gate (#70) 6df4968679

Promote dev → main (frontend QA batch → beta) (#71) ca84e0ce95

Retire NASA POWER from every serving path (#72) 005567dc51

Merge pull request 'Promote dev to main: NASA retirement' (#73) from dev into main f596fa87d8

admin_emi merged commit 51889d6979 into release 2026-07-24 23:59:27 +00:00

admin_emi referenced this pull request from a commit 2026-07-24 23:59:29 +00:00

Merge pull request 'Promote main to release: NASA retirement' (#74) from main into release

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Jinemi/thermograph#74

No description provided.