Grant Whitmer 1c3b5b0638 telemetry: synthetic:true on canary refusals (keyed, not a bare flag) ...

The canary deliberately sends forged tokens every 10 min; those refusal
rows read as attacks. It now sends X-Windy-Synthetic carrying a shared
secret (Gitea repo secret CANARY_SYNTHETIC_KEY = WINDYGIT_SYNTHETIC_KEY in
Veron .env); the API marks the row synthetic only on a constant-time
match, so an attacker cannot label their own refusals synthetic to hide.
synthetic is declared on forge.auth.failed (Telemetry Boss, UPDATE 3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 11:54:56 -04:00

..

backup.sh

security: never bundle credential repos to R2 in plaintext

2026-09-23 10:48:42 -04:00

canary.py

telemetry: synthetic:true on canary refusals (keyed, not a bare flag)

2026-09-23 11:54:56 -04:00

cancel_unrunnable.sh

telemetry: ci.job_cancelled from the janitor; interval_s on heartbeat

2026-09-23 11:27:53 -04:00

cancel_unrunnable.sql

telemetry: ci.job_cancelled from the janitor; interval_s on heartbeat

2026-09-23 11:27:53 -04:00

import_from_github.py

ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script

2026-09-23 09:49:15 -04:00

pr_status_bridge.py

ci: windy-pro desktop/installer jobs are NON-BLOCKING (Grant, 09-23)

2026-09-23 10:58:07 -04:00

promote_to_ci.sh

ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script

2026-09-23 09:49:15 -04:00

sync_from_github.sh

telemetry: CI emitter for admin.windyword.ai (inert until token)

2026-09-23 11:06:54 -04:00

telemetry_emit.py

telemetry: fix ci.run completeness — cursor on (finish time, job id)

2026-09-23 11:42:36 -04:00

vocab_audit.py

G0: cell substrate — invariants made executable

2026-08-11 14:19:28 -04:00