rdmpw3275m-changelog-20260923-1508-cloudflare-rotation-and-mergefleetevents-resolution

Resolution of SEC-20260831-01 (Cloudflare credentials rotation) and ISSUE-20260914-15 (Tyrell mergeFleetEvents canary soak closure).

Summary

Rich provided rotated Cloudflare API credentials for mute-mouse-c177 and gave the directive to apply changes without soak for Tyrell mergeFleetEvents. Both items have been executed, verified, and resolved across the fleet estate.

Scope & Actions Executed

1. SEC-20260831-01 (Cloudflare Key Rotation)

• Status: RESOLVED
• Validation:
  • Verified rotated token for mute-mouse-c177 via Cloudflare v4 API (/accounts/<account-id>/tokens/verify): returned status: active and "This API Token is valid and active".
  • Verified account-level permissions and zone access: token grants write access across account resources and all managed zones (including dataroo.net, dev.ecs0.net, and 20+ additional zones).
• Environment Updates:
  • Updated ~/.secrets/global.env (mode 600) with new values for CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, CLOUDFLARE_TOKEN_NAME, CLOUDFLARE_TOKEN_ID, CLOUDFLARE_R2_ACCESS_KEY_ID, CLOUDFLARE_R2_SECRET_ACCESS_KEY, CLOUDFLARE_R2_ENDPOINT, and CLOUDFLARE_GLOBAL_API_KEY.
  • Replicated updated global.env from canonical rdmsm4x to all 5 spoke nodes (rdmbair15m5, rdmbair13m5, jdmbair13m5, rdmpw3265m, rdmpw3275m) with strict mode 600 permissions.
  • Sanitized historical command approvals in ~/.gemini/antigravity-cli/settings.json on rdmsm4x to eliminate references to the retired credential.

2. ISSUE-20260914-15 (Tyrell mergeFleetEvents)

• Status: RESOLVED
• Directive: Rich instructed: "no soak, apply changes, stability will show itself: 1. ISSUE-20260914-15 (Tyrell): mergeFleetEvents soak under automated canary guard."
• Evidence:
  • Correctness fix in commit 3834d4522aad647411385a244d882c80194af3c1 (ActivityEventBufferActor.mergeFleetEvents structured Hashable EventKey) is fully merged into main and running in production.
  • Suite verification: 553 XCTest cases and 669 Swift Testing cases pass with zero failures.
  • Daemons active and healthy fleet-wide on port 43117.

3. Fleet Synchronization

• Ran ticket sync --apply across 191 projects.
• ticket mine is clean (0 active claims held).