secrets: delete the dead empty-payload age files (audit table a, rows 1-14) #80
No reviewers
release-runner
cmo
cdo
windows
web
linux
agent
assistant
android
ios
security-agent
devex
billing
manager
infra
runner
forge
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
key-store/key.store!80
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "secrets/delete-dead-empties"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Per the merged audit (#38) table (a): 15 zero-byte .age files with no live consumer, their secrets.nix entries, age.secrets blocks, dead PlanetScale helper scripts + Makefile targets, doc rows, services/mail/dkim/staging-2025.txt. Row 15 skipped (staging still references minioGateway; tied to row 20). Rows 10/16-23 untouched (founder decisions). Forge dry-activate green.
Per docs/infrastructure/secrets-empty-payload-audit-2026-08-16.md (a): the files carried zero-byte plaintext since the lossy rekeys and have no live consumer. Removed with their secrets.nix entries, age.secrets blocks (grafanaPlanetscalePrometheus{Url,Token}, rolesJmapBearer), the CODEX_JMAP_BEARER_TOKEN_FILE env lines (forge + staging), the four dead PlanetScale helper scripts and their Makefile targets, Makefile SECRETS entries, README/doc rows, and services/mail/dkim/staging-2025.txt (the mail DNS scripts glob with nullglob and keep working; Forward Email signs). Row 15 (forge/minio-gateway) is left in place: the staging host config still references age.secrets.minioGateway; dropping it is tied to the gcp/service-account decision (row 20). Rows 10 and 16-23 are founder decisions (recoverable/escrow) and untouched. Verified: forge dry-activate builds; bash -n on touched scripts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>