Per-agent PostgreSQL accounts + retire shared/ltm.md creds
Per-agent PostgreSQL account provisioning (venus telemetry cluster, PG17). Every agent/script/service doing ad-hoc DB work gets its own scram-sha-256 role + password in $HOME/.config/postgres/<agent-name>.env (git-ignored, matches the nw-venus-cc/bin_venus_cc/monitor_context_cc pattern already in place). Must also: (1) sweep ltm.md and any other memory/env files fleet-wide for stray/shared DB creds and retire them once an agent has its own role, (2) revoke rob's PG SUPERUSER once migration is complete (currently superuser: rob, postgres, nw-venus-cc), (3) land the global CLAUDE.md rule: project-provided DB instructions win; else source ~/.config/postgres/<agent-name>.env if present; else DM nw-venus-cc to provision a role. Elazar GO 2026-09-02, blocked on his bandwidth to review the account list/rollout before nw-venus-cc executes at fleet scale.
Activity
-
Elazar: 'i can't now' (2026-09-02) - needs his review before nw-venus-cc executes per-agent PG account rollout at fleet scale
-
bin-venus-cc report 2026-09-02: (1) role bin_venus_cc existed with no env file - fixed, ~/.config/postgres/bin-venus-cc.env now provisioned (password reset via ALTER ROLE, verified live login). (2) role-name punctuation is NOT consistent (bin_venus_cc/monitor_context_cc/telemetry_ro use underscores, nw-venus-cc uses hyphens) - rollout must NOT derive role name from agent name by substitution; each env file states PGUSER explicitly (already true for nw-venus-cc.env/bin-venus-cc.env). (3) REVOKE RISK, must fix before revoking rob SUPERUSER: 16 scripts in ~/.local/bin connect to PG as rob via local socket, several do runtime DDL (kpi-burn-alert.sh CREATE/ALTER on its state store, token-usage-collect.sh ALTER ADD COLUMN + CREATE INDEX) - these need their target role's grants in place BEFORE the revoke or they fail on next timer fire. bin-venus-cc offered to enumerate exact per-script grants needed; asked them to do so as an OPS-191 prerequisite.
-
bin-venus-cc RETRACTED the DDL-grants prerequisite: over-count from grepping write-verbs+psql - journal-digest.sh/db-generate-wrapper.sh matches were prose not code, kpi-burn-alert.sh/token-usage-collect.sh DDL targets are SQLITE not postgres. No script in ~/.local/bin connects as ambient rob - all name explicit identities (-U, PGSERVICE, DATABASE_URL, DSN). Revoking rob SUPERUSER does not touch any timer; exposure is interactive/agent bare-psql-as-rob use only, which is the point of the revoke. Prerequisite REMOVED from OPS-191 scope. Role sweep: 12 login roles, 2 env files pre-existing; per-agent gap found+fixed for monitor_context_cc (env file provisioned, password reset, verified live) alongside bin_venus_cc done earlier. Remaining 9 roles are service/superuser roles whose creds correctly live elsewhere, not gaps. ONE REAL PREREQUISITE KEPT: every non-superuser login role currently holds TEMPORARY on telemetry via PUBLIC - llmmsg-kpi-report.sh does CREATE TEMP TABLE x3. If any future tightening pass revokes TEMPORARY from PUBLIC, must GRANT TEMPORARY explicitly first to whichever role runs the analytics timers, or that report breaks.
-
GO received via pmmaster-evolutiva-cc on Elazar's behalf 2026-09-11 11:29 ART (relayed GO = real GO). Role-provisioning leg already done+verified 2026-09-02 (nw-venus-cc/bin-venus-cc/monitor_context_cc; 9 remaining roles are service/superuser, correctly elsewhere). Remaining: (1) fleet-wide ltm.md/env stray-creds sweep - starting now. (2) rob-SUPERUSER revoke stays blocked on bin-venus-cc's per-script grant enumeration.
-
Local venus-cluster stray-cred sweep CLEAN (4 local per-agent env files, PGPASSWORD-value grep vs ltm.md/memory/bin/scripts, zero hits outside own file). Remote-cluster attribution leak found in ltm.md (mars Supabase creds) - flagged to pmmaster as separate scope question, not OPS-191 unless they say so. rob-superuser revoke still blocked on bin-venus-cc grant enumeration - asked directly 2026-09-11.
-
rob-superuser revoke: bin-venus-cc confirms grant enumeration not started, queued behind OPS-210 (P1), deferred to after 18:50Z cap reset per pmmaster throttle. Not dated on my end - no objection.