Credential rotation, /bin divergence, and a new substrate umbrella — 2026-05-29 session report

Surfaces touched: dash.dare.co.uk · evernote.gf.cx (new) · ~/bin/ · 1Password (Code Shared) · GitHub Actions (xlab-nyc/dare-pipeline) · Cloudflare API tokens

TL;DR

• evernote.gf.cx is live as the corpus-level umbrella for migrating 17 years of Evernote (~24K notes) into an owned, local-first markdown substrate. Holding card with 11-panel R/Y/G status-of-the-stack shipped; existing ENEX ingester repointed via env-var; pa.gf.cx will pull a country-house slice via join.
• dash.dare.co.uk Edge Health panel — pills always flush right, baseline text removed. Two iterations (first conditional-on-tripwire, then unconditional per a cleaner read on healthy state); empirically verified via Chrome DevTools MCP both times.
• op (1Password CLI) FDA grant fixed — the “op would like to access data from other apps” prompt was missing Full Disk Access on the shim path. Added /opt/homebrew/bin/op to FDA → biometric Touch ID layer now reachable. 3-prompt decoder table now in the memory archive.
• Credential rotation playbook stress-tested — CDN, security layer, and DNS provider sitting in front of dare.co.uk.">CF API token for the GHA dashboard deploy went through five iterations before landing right. Root cause was not the token itself but a missing Account Resources binding that the CDN, security layer, and DNS provider sitting in front of dare.co.uk.">CF console quietly drops at create-time. Workaround: hardcode CLOUDFLARE_ACCOUNT_ID in the workflow yaml so wrangler skips the broken /accounts auto-discovery.
• Structural trap surfaced: ~/Code/dare-pipeline/scripts/ ↔ ~/bin/ are two separate copies, not symlinks. Today’s CSS edit went to the repo (which GHA reads); the local hourly launchd reads from ~/bin/ and was overwriting the GHA-deployed HTML with stale CSS on every cron tick. Same risk applies to most of ~/bin/dare_*.py and ~/bin/pa_*.py.
• Five memories captured — three of them are hard rules (no interpunct in 1P labels, verify UI changes empirically via MCP, sync ~/bin/ alongside repo edits). One is a project (evernote.gf.cx migration). One is a reference (Gemini sandbox 1P item).

Timeline · the day at a glance

What shipped

1 · evernote.gf.cx — corpus-level migration umbrella

A new subdomain announcing migration-in-progress posture. The holding card carries 11 R/Y/G status panels covering the substrate-locus decision, the API-closed reality, the existing ingester, the cull pipeline (designed in 2026-05-22 parked sketch), the R2 bucket, the public/private split, and the MCP role-when-it-ships. Greens-first ordering so the reader sees what’s locked in before what’s still open.

Architectural decision locked in: evernote.gf.cx is the corpus umbrella. pa.gf.cx will pull a country-house-relevant slice via join. One source of truth, multiple audience-projected views — matches the throughline-of-connected-surfaces principle. Avoids the duplicate-substrate cost.

Ingest pipeline: ~/bin/pa_evernote_enex_ingest.py is full-featured (stream-parses GB-sized ENEX, preserves raw ENML losslessly, ENML→markdown best-effort, en-crypt blocks verbatim, sha1-deduped resources). Patched to read PA_EVERNOTE_INBOX and PA_EVERNOTE_SUBSTRATE env vars — defaults preserved so the pa workflow stays intact; new defaults point at evernote.gf.cx when set. Dry-run validated on inspiration.enex, then real ingest tested. Output shape matches the 2026-05-22 design (md + ENML + JSON + per-note resources dir).

Cull pipeline (parked): designed in the 2026-05-22 parked sketch — per-note Haiku Layer-2 value_signal scoring → Diamond/Gold/Reference/Archive/Noise tiering → Dan-validated curation UI on Diamonds. Total cost ~$25–35 one-shot for the full 24K. Blocked on ENEX exports landing + R2 bucket creation. Resume conditions noted on the parked sketch entry.

2 · dash.dare.co.uk · Edge Health pills always flush right, baseline removed

Two-commit cycle. First commit (b6b6e2e) used a :has() rule that surfaced the baseline only in tripwire state. Second commit (0af19c0) dropped the conditional per Dan’s clarified read — the baseline text is noise in every state, not just healthy. Final CSS is one line: .edge-baseline { display: none; }. Pills inherit flush-right alignment from .edge-meta’s existing justify-content: flex-end once the baseline span stops occupying space.

Browser-verified across all four windows (24h, 7d, 30d, 90d). Confirmed via getComputedStyle() + getBoundingClientRect() that the toggle’s right edge is within 2px of the meta container’s right edge, and baseline display is none regardless of how many .edge-card.red-alert cards are present in the active window’s grid.

3 · op CLI Full Disk Access — silently broken, now fixed

The “op would like to access data from other apps” macOS TCC prompt was firing on every invocation. Diagnosed by querying ~/Library/Application Support/com.apple.TCC/TCC.db directly: op had three path-keyed grants (Downloads, AppBundles, AppData) tied to the resolved Caskroom path /opt/homebrew/Caskroom/1password-cli/2.34.0/op, but no FDA grant at all. Fix: add /opt/homebrew/bin/op (the shim, durable across brew upgrade 1password-cli) to Full Disk Access via System Settings.

Memory archive now carries a three-prompt decoder for the op auth chain: “access data from other apps” wording = macOS TCC layer = FDA fix; “1Password is trying to authenticate” wording = 1P.app biometric = Touch ID once per 10-min idle; “Allow op (X.Y.Z) to integrate” wording = 1P.app per-binary CLI allow-list = one click per 1P.app upgrade. Reading the dialog wording tells you which gate is failing.

The credential rotation cycle — what actually happened

The afternoon was dominated by a CDN, security layer, and DNS provider sitting in front of dare.co.uk.">CF token rotation that took five iterations. Worth a clean post-mortem:

Then the real twist. The successful GHA deploy at 18:28 was overwritten 19 minutes later at 18:47:44 by another deploy — source None (i.e. not from GHA). That was the local uk.co.dare.dashboard launchd cron firing hourly, reading from ~/bin/dare_cf_analytics.py (a separate copy of the script, NOT a symlink to the repo), generating HTML from the stale version, and deploying it on top of the GHA deploy.

Confirmed via Chrome DevTools MCP: dash.dare.co.uk was serving deployment 354f137b (local launchd) instead of 410aa27a (GHA), and the CSS rules in the stylesheet showed only the old .edge-baseline[hidden] { display: none; } rule, not the new :has() rule from my edit.

Fix: cp the repo file → ~/bin/, re-trigger GHA. Then dash.dare.co.uk consistently served the new CSS, verified via MCP. Both pipelines (GHA + local launchd) now produce equivalent output.

Memories captured

Five entries durably saved to the memory archive. Three are sharp negative-feedback rules; one is a structural project record; one is a vault-pointer reference.

1. feedback_op_cli_fda_grant_via_shim_path_2026-05-29.md — Three-prompt decoder for op auth (FDA wording vs Touch ID wording vs 1P-allow-binary wording). Add op via the shim path /opt/homebrew/bin/op to FDA, not via Allow-on-prompt (which pins to Caskroom path and breaks on upgrade).
2. feedback_1password_item_labels_keep_clean_2026-05-29.md — HARD RULE. Never propose 1P item names with interpunct (·), em-dash, pipe, bullet, or any non-ASCII separator. Plain ASCII space separators only. Three-token shape <Vendor> <ctx> <use-case> is fine; the forbidden thing is the fancy separator. Dan’s exact reaction: “I was shocked you introduced the interpunct. Dont do that!”
3. feedback_verify_empirically_via_browser_mcp_2026-05-29.md — HARD RULE. For any UI change, never claim “it’s live” based on git-push / GHA-green / curl-grep alone. Required proof: MCP-navigate the URL + evaluate_script the actual getComputedStyle() / DOM state. Browser is the source of truth.
4. feedback_repo_vs_bin_dual_copy_divergence_2026-05-29.md — HARD RULE. Dan’s scripts exist as TWO files: ~/Code/<repo>/scripts/foo.py (git-tracked, GHA reads) and ~/bin/foo.py (launchd + shell PATH reads). Not symlinked. Editing the repo doesn’t update ~/bin/. After any edit, sync via cp and verify with md5.
5. feedback_pasted_command_after_action_announcement_is_narration_2026-05-29.md — “ok deploying now” + a pasted command in the next message = Dan is running it himself, not delegating. Acknowledge + watch, don’t re-run.

Plus: - project_evernote_gf_cx_migration_2026-05-29.md — scaffold record + architectural decisions - parked_sketch_evernote_cull_tooling_on_surface_2026-05-29.md — cull pipeline build plan w/ resume conditions - reference_1password_gemini_sandbox_gfcx_wrap_comp_2026-05-29.md — Gemini sandbox cred pointer - feedback_gfcx_subdomain_scaffold_template_gaps_2026-05-29.md — Rocket Loader data-cfasync="false" not yet baked into the gfcx_subdomain_new template; manually patched on evernote.gf.cx, but should be fixed at template source for future scaffolds

What’s still open

Day spent dominated by credential plumbing; net yield is structural — three hard rules, a working migration substrate, and a dashboard cycle that closed cleanly once the dual-copy trap was visible. The plumbing time would have been cheaper with the empirical-verification rule in place from the start.