What kind of rotation is this?

  Routine (calendar / proactive)
    -> Pick the secret, follow its procedure below.

  Forced by provider (key expired, vendor rotated)
    -> Same procedure but you don't get to control timing —
       the integration is already broken.

  Suspected compromise (logs show unexpected access, key leaked)
    -> Rotate ALL of: every OAuth client secret (via
       `poindexter auth migrate-*`), jwt_secret_key, revalidate_secret,
       every webhook secret. Run "Re-seed all" below.

  Lost POINDEXTER_SECRET_KEY (encrypted blobs unreadable)
    -> See disaster-recovery.md CONFIG-2, then come back here and
       follow "Re-seeding from scratch" for every secret you actually use.

# 1. Generate at the provider — copy the new value into a secure clipboard
#    (or generate locally for self-issued tokens)

# 2. Save to a 0600 file so we don't echo it
NEWVAL_FILE=$(mktemp)
chmod 600 "$NEWVAL_FILE"
# Paste the new value into $NEWVAL_FILE; save and exit.
# (or:  echo -n "<new value>" > "$NEWVAL_FILE"  --  but this exposes it in shell history)

# 3. Set the new value via plugins.secrets (encrypts under current key)
docker exec -i poindexter-worker python -c "
import asyncio, asyncpg, os, sys
sys.path.insert(0, '/app/src/cofounder_agent')
from plugins.secrets import set_secret
async def main():
    val = open('/tmp/newval').read().strip()
    conn = await asyncpg.connect(os.environ['DATABASE_URL'])
    await set_secret(conn, '<KEY>', val)
    await conn.close()
asyncio.run(main())
" </tmp/newval

# Or: poindexter settings set <key> "<value>" --secret   if you accept the value being on the cmdline.
# Prefer the helper above for true secrets.

# 4. Restart any consumer that caches at startup
docker restart poindexter-worker     # most secrets — async-fetched per request
# (some specific ones need additional restarts — see the per-key sections)

# 5. Verify with a real downstream call (see per-key sections)

# 6. Revoke the old value at the provider

# 1. Change the postgres password
docker exec -it poindexter-postgres-local psql -U poindexter -d postgres
# In psql:
ALTER USER poindexter WITH PASSWORD '<new password>';
\q

# 2. Edit ~/.poindexter/bootstrap.toml — update the connection string
chmod 600 ~/.poindexter/bootstrap.toml

# 3. Restart everything that connects to the DB
docker restart poindexter-worker poindexter-brain-daemon poindexter-grafana

curl -s http://localhost:8002/api/health | python -m json.tool
# database.connected should be true

# 1. Generate a new key (save it RIGHT NOW to 1Password)
NEW_KEY=$(python -c "import secrets; print(secrets.token_urlsafe(48))")
echo "$NEW_KEY"
# Paste this into 1Password. DO NOT lose it.

# 2. Capture the current key
OLD_KEY="$POINDEXTER_SECRET_KEY"

# 3. Run the rotation (re-encrypts every is_secret=true row)
docker exec -i poindexter-worker python -c "
import asyncio, asyncpg, os, sys
sys.path.insert(0, '/app/src/cofounder_agent')
from plugins.secrets import rotate_key
async def main():
    conn = await asyncpg.connect(os.environ['DATABASE_URL'])
    n = await rotate_key(conn, old_key='$OLD_KEY', new_key='$NEW_KEY')
    print(f'Rotated {n} secret(s)')
    await conn.close()
asyncio.run(main())
"
# Expected: "Rotated <N> secret(s)" (matches your is_secret=true count)

# 4. Update bootstrap.toml with the new key
# Edit POINDEXTER_SECRET_KEY = "<new key>"  in ~/.poindexter/bootstrap.toml

# 5. Restart everything that decrypts secrets
docker restart poindexter-worker poindexter-brain-daemon

# Trigger a decrypt round-trip
curl -s http://localhost:8002/api/health
docker logs poindexter-worker 2>&1 | grep -i "SecretsError"
# Expected: no SecretsError lines after the restart.

# Rotate one consumer
poindexter auth migrate-cli            # CLI
poindexter auth migrate-mcp            # public MCP server
poindexter auth migrate-mcp-gladlabs   # operator MCP server
poindexter auth migrate-brain          # brain daemon
poindexter auth migrate-scripts        # ad-hoc scripts client
poindexter auth migrate-openclaw       # OpenClaw bridge

# Or rotate the Grafana token (different shape — used for the brain's
# Grafana alert sync loop)
poindexter auth mint-grafana-token

# Restart consumers so they re-read their configs
docker restart poindexter-worker poindexter-brain-daemon
# Restart Claude Desktop / OpenClaw gateway so they re-read their JSON configs.

# Mint a fresh JWT and hit the worker
JWT=$(poindexter auth mint-token --client cli)
curl -sH "Authorization: Bearer $JWT" http://localhost:8002/api/health \
  -o /dev/null -w "%{http_code}\n"
# Expected: 200

# An old (pre-rotation) JWT or an unprovisioned client should 401

# 1. Generate
NEW=$(python -c "import secrets; print(secrets.token_urlsafe(32))")

# 2. Set in DB
poindexter settings set revalidate_secret "$NEW" --secret   # OR use set_secret helper

# 3. Update on Vercel — this MUST happen within seconds of step 2,
#    otherwise revalidation 401s until you do.
vercel env rm REVALIDATE_SECRET production
echo "$NEW" | vercel env add REVALIDATE_SECRET production

# 4. Trigger a Vercel redeploy so the new env var lands in the runtime
vercel --prod

# 5. Restart worker so it picks up the new value
docker restart poindexter-worker

# Trigger a revalidation against a real post slug
curl -s -X POST http://localhost:8002/api/revalidate \
  -H "Authorization: Bearer $(poindexter auth mint-token --client cli)" \
  -d '{"path": "/posts/<some-slug>"}'
# Expected: {"revalidated": true}

# Check Vercel logs for the revalidation hit
vercel logs --follow | grep revalidate

# 1. Generate
NEW=$(python -c "import secrets; print(secrets.token_urlsafe(32))")

# 2. Set in DB
poindexter settings set openclaw_webhook_token "$NEW" --secret   # OR use set_secret helper

# 3. Update OpenClaw config
# Edit ~/.openclaw/openclaw.json — set the gateway's expected token.

# 4. Restart both
docker restart poindexter-worker
# Restart OpenClaw (Windows shortcut or:)
start "OpenClaw Gateway" cmd /d /c "%USERPROFILE%\.openclaw\gateway.cmd"

docker restart poindexter-alertmanager

# 1. Open Telegram, message @BotFather:
#    /mybots -> select your bot -> API Token -> Revoke current token
#    BotFather hands you the new token. Save it.

# 2. Set in DB
poindexter settings set telegram_bot_token "<new-token>" --secret

# 3. ALSO update bootstrap.toml fallback (for operator notifications when DB is down)
# Edit ~/.poindexter/bootstrap.toml -> telegram_bot_token = "<new-token>"
chmod 600 ~/.poindexter/bootstrap.toml

# 4. Restart consumers
docker restart poindexter-worker poindexter-brain-daemon
# Telegram bot daemon (if running standalone):
# Windows: pythonw scripts/telegram-bot.py

# Trigger a test alert to your chat
curl -s -X POST http://localhost:8002/api/test/notify-operator \
  -H "Authorization: Bearer $(poindexter auth mint-token --client cli)"
# Expected: a Telegram message arrives within seconds.

# 1. Open https://discord.com/developers/applications
#    -> select app -> Bot -> Reset Token (this revokes the old one immediately)
#    Copy the new token.

# 2. Set in DB
poindexter settings set discord_bot_token "<new-token>" --secret

# 3. Restart Discord bot consumer
docker restart poindexter-worker
# If voice bot is separate: docker restart poindexter-voice-bot

# 1. In Discord: Server Settings -> Integrations -> Webhooks
#    -> select webhook -> Copy Webhook URL (regenerates if needed)

# 2. Set in DB
poindexter settings set discord_ops_webhook_url "https://discord.com/api/webhooks/.../...token" --secret

# 3. ALSO update bootstrap.toml fallback if this is the ops webhook
# Edit ~/.poindexter/bootstrap.toml -> discord_ops_webhook_url

# 4. Restart consumers
docker restart poindexter-worker poindexter-brain-daemon

# 1. In Lemon Squeezy dashboard: Settings -> Webhooks -> select your webhook
#    -> "Reveal Signing Secret" / "Regenerate"
#    Copy the new value.

# 2. Set in DB
poindexter settings set lemon_squeezy_webhook_secret "<new-secret>" --secret

# 3. Restart worker so the verifier reads the new value on next request
#    (Actually, since the verifier is async and reads per-request, this
#     might not strictly require a restart — but do it anyway for safety.)
docker restart poindexter-worker

# 1. https://resend.com/api-keys -> Delete old key, Create new key
# 2. poindexter settings set resend_api_key "<new-key>" --secret
# 3. docker restart poindexter-worker

# 1. Generate / obtain new SMTP password from your email host
# 2. poindexter settings set smtp_password "<new-pw>" --secret   # encrypts at rest (pgcrypto)
# 3. docker restart poindexter-worker

# 1. In Uptime Kuma: Settings -> API Keys -> Create / Regenerate
#    Copy the new key.

# 2. poindexter settings set uptime_kuma_api_key "<new-key>" --secret

# 3. docker restart poindexter-worker poindexter-brain-daemon

# 1. https://platform.openai.com/api-keys -> Revoke old, Create new
# 2. poindexter settings set openai_api_key "sk-..." --secret
# 3. docker restart poindexter-worker

# 1. https://console.anthropic.com/settings/keys -> Revoke old, Create new
# 2. poindexter settings set anthropic_api_key "sk-ant-..." --secret
# 3. docker restart poindexter-worker

# 1. https://www.pexels.com/api/new -> regenerate / new key
# 2. poindexter settings set pexels_api_key "<new-key>" --secret
# 3. docker restart poindexter-worker

# 1. https://console.cloudinary.com/settings/api-keys -> regenerate
# 2. poindexter settings set cloudinary_api_key "<new-key>" --secret
#    poindexter settings set cloudinary_api_secret "<new-secret>" --secret
# 3. docker restart poindexter-worker

# 1. At your storage provider (R2/S3/etc.) -> create new access key, deactivate old
# 2. poindexter settings set storage_secret_key "<new-key>" --secret
#    poindexter settings set storage_token "<new-token>" --secret
# 3. docker restart poindexter-worker

# 1. Update Redis password
# Edit redis.conf or run:
docker exec poindexter-prefect-redis redis-cli CONFIG SET requirepass "<new-password>"

# 2. Build new URL: redis://default:<new-password>@<host>:<port>
# 3. poindexter settings set redis_url "redis://default:<new-password>@..." --secret
# 4. docker restart poindexter-worker

# 1. http://localhost:3000 (or http://<your-tailnet-ip>:3000 via tailnet) ->
#    Administration -> Service accounts -> Add service account ->
#    "alert-sync" with Editor role -> Add token
# 2. poindexter settings set grafana_api_key "<new-key>" --secret
#    poindexter settings set grafana_api_token "<new-token>" --secret   # if both rows exist
# 3. docker restart poindexter-worker

[ ] OAuth client secrets            (#critical — re-run `poindexter auth migrate-*` for every consumer)
[ ] revalidate_secret               (#critical — Vercel ISR)
[ ] telegram_bot_token              (#critical — alerts)
[ ] discord_bot_token               (if used)
[ ] discord_*_webhook               (per channel)
[ ] openclaw_webhook_token          (if OpenClaw is wired)
[ ] alertmanager_webhook_token      (if Alertmanager is wired)
[ ] lemon_squeezy_webhook_secret    (if accepting payments)
[ ] resend_api_key + resend_webhook_secret  (if sending newsletters)
[ ] uptime_kuma_api_key             (if pushing to Kuma)
[ ] openai_api_key                  (only if you actively use it)
[ ] anthropic_api_key               (cross-model QA)
[ ] gemini_api_key                  (only if you actively use it)
[ ] pexels_api_key                  (image fallback)
[ ] cloudinary_api_key + secret     (image CDN)
[ ] storage_secret_key + token      (R2/S3 — required for static export)
[ ] redis_url                       (if Redis is wired)
[ ] devto                           (cross-post adapter)
[ ] grafana_api_key + token         (if calling Grafana API from worker)

# Confirm the row is encrypted (starts with enc:v1:)
docker exec poindexter-postgres-local psql -U poindexter -d poindexter_brain -c \
  "SELECT key, value LIKE 'enc:v1:%%' AS encrypted, length(value) AS len, updated_at
   FROM app_settings WHERE key = '<KEY>';"

# Confirm the worker can decrypt it (no SecretsError in logs)
docker logs poindexter-worker --since=2m 2>&1 | grep -i "SecretsError\|<KEY>"

# Trigger a downstream call that uses the secret. Look for HTTP 2xx, not 401.