# Session 018 -- GitHub SSOT: Design, Artifacts, Token Rotation, Cleanup

## Date: 2026-02-16 17:00 UTC

## Summary
Designed and built the comprehensive GitHub SSOT setup. Created all offline artifacts (community docs, dependabot, cleanup/seeder scripts). Rotated GitHub tokens (old ones revoked, new ones installed server-wide). Pushed to GitHub, synced develop. Cleanup script running (closing 28 duplicate issues), blocked on rate limit reset.

## What Was Done

### 1. Token Rotation (Server-Wide)
- New classic PAT installed via `gh auth login --with-token`
- New fine-grained PAT saved to `/home/dev/shared/secure/tokens/github-fine-grained.token`
- Verified: `gh auth status`, `gh api user`, `git push --dry-run` — all pass
- Account still flagged: 60/hr REST, 0/hr GraphQL
- Updated deferred blocker P0-github-token-revoked.md → RESOLVED

### 2. GitHub SSOT Design
- Brainstorming skill with 3 parallel research agents (completed last session)
- Synthesized into design doc: `docs/plans/2026-02-16-github-ssot-design.md`
- User approved design covering: issue taxonomy (135 items), labels, milestones, community docs, scripts

### 3. Community Docs Created
- `SECURITY.md` — vulnerability disclosure policy (brendon@llmhosts.com)
- `CONTRIBUTING.md` — setup, branching, commits, PR process, code standards
- `CODE_OF_CONDUCT.md` — Contributor Covenant v2.1
- `.github/dependabot.yml` — weekly pip + npm + GitHub Actions updates

### 4. GitHub Tooling
- **`tools/github-cleanup.py`** — closes 28 known duplicate issues, verifies labels/milestones
- **`tools/seed-github-issues.py`** — full rewrite:
  - Parses all 11 backlog epic files programmatically
  - Handles both `### ID: Title` and table formats
  - 135 backlog items discovered (11 caching + 17 compute + 16 conductor + 7 email + 21 frontend + 12 hive-ceo + 9 hive-mode + 9 observability + 14 onboarding + 13 security + 6 self-evolution)
  - Structured issue bodies with epic/backlog-id/phase/size metadata
  - Proper labels (epic, phase, priority, status, size)
  - Phase → milestone mapping from GitHub API
  - Dedup via title matching (fallback to individual issue probing for flagged accounts)
  - `--batch=N` mode for rate-limit-friendly incremental runs
  - `--epic=NAME` filter for targeted seeding

### 5. Git Operations
- Committed all artifacts: `5bc7441`
- Pushed to `origin/main`
- Fast-forward merged and pushed `origin/develop`
- Both branches synced at `5bc7441`

### 6. GitHub Cleanup (IN PROGRESS)
- Running in background, waiting for rate limit reset (~47 min from session time)
- Will close 28 duplicate issues (#44-#97 from second seeder run)
- Will verify 3 missing labels (epic:hive-ceo, status:ready, status:in-progress)
- Will verify 4 milestones

## Commits This Session
| Commit | Description |
|--------|-------------|
| `5bc7441` | feat: GitHub SSOT artifacts -- community docs, dependabot, cleanup + seeder scripts |

## Codebase Metrics
| Metric | Count |
|--------|-------|
| Tests | 301 (all passing) |
| GitHub issues (before cleanup) | 57 (29 unique + 28 duplicates) |
| GitHub issues (after cleanup) | ~29 unique |
| Backlog items parsed by seeder | 135 |
| Issues to seed | ~106 (135 total - 29 existing) |

## Files Created/Modified
| File | Purpose |
|------|---------|
| `SECURITY.md` | Vulnerability disclosure policy |
| `CONTRIBUTING.md` | Contribution guidelines |
| `CODE_OF_CONDUCT.md` | Contributor Covenant v2.1 |
| `.github/dependabot.yml` | Automated dependency updates |
| `tools/github-cleanup.py` | Duplicate issue cleanup + label verification |
| `tools/seed-github-issues.py` | Full rewrite: backlog → GitHub issues |
| `docs/plans/2026-02-16-github-ssot-design.md` | Design document |
| `deferred/P0-github-token-revoked.md` | Updated: RESOLVED |

## Current Branch State
- `main` = `develop` = `origin/main` = `origin/develop` (all synced at `5bc7441`)

## What Is Needed Next

### Immediate (rate-limit dependent)
1. **Cleanup completes** — 28 duplicates closed, labels verified
2. **Run seeder** — `python -u tools/seed-github-issues.py --batch=15` (iterative, ~9 runs needed)
3. After all 135 items seeded, 29 existing issues may need label updates

### Deferred Blockers (unchanged)
| Priority | Item | Status |
|----------|------|--------|
| P0 | GitHub account flag | Waiting on GitHub (60/hr REST, 0/hr GraphQL) |
| ~~P0~~ | ~~GitHub PAT revoked~~ | RESOLVED (new tokens 2026-02-16) |
| P0 | GitHub Pro upgrade | Blocked by flag |
| P1 | Branch protection, Projects, Discussions | Blocked by Pro/flag |
| P2 | SSH key registration | Mitigated by HTTPS |

### Revenue Critical Path (from session-017)
1. Next.js plans page
2. Plan sync: Next.js ↔ Python proxy
3. Frontend key management UI
4. TestPyPI publish
