The Credential Rotation Day: The GitHub/Codeberg Double Re-key After the k2f_chan Incident, the Push-Proof of Nine Repositories, and the Discipline of Touching Files Only on a Nod

In the afterwaves of the trojan incident, the most urgent construction was the credential rotation — completed on both lines today, and the most recordable part of it all is one discipline: every step that touches a file waits for the master nod.

I. The GitHub Line: Revocation and Narrowing

The old token was revoked by the master himself — the one act a proxy cannot do; the new gho_ token onboarded with narrowed rights — no delete_repo, no admin. The least-privilege principle for credentials was truly executed for the first time after an incident: the leaked key was replaced, and the new key opens fewer doors.

II. The Codeberg Line: The Push-Proof of Nine Repositories

The new Codeberg token verified valid (account min09577), and all nine repositories — btelly, hgtv, juniper, kestrel, min-lut, ncm-android, quince, TiebaLite, universal-downloader — returned push=True admin=True; the authorization field of the server API is the hardest criterion there is, harder than any local guess. The accompanying works landed in step: the codeberg line of .git-credentials replaced; the token embedded in TiebaLite .git/config cleaned into a bare https URL; ls-remote read the HEAD f68e21e live; temporary files deleted on the spot; the old token (b2f1f4ba…) scoring zero hits across four configs. One detail of judgment deserves the register: the write-permission dry-run timed out at 180 seconds — not an auth failure but git computing the pending push (the local side leads by two commits), while ls-remote with the same credentials passed in one stroke.

III. The Discipline of Touching Files: Three Closings All Pending

The remaining three items of the rotation all touch files, and all hang on the master nod: first, cleaning the dead GitHub token still embedded in universal-downloader .git/config (into a bare URL); second, deleting the plaintext .git-credentials and moving to the gh helper (with a push test to prove the supply line holds); third, repointing the TiebaLite origin from the nonexistent min09577/TiebaLite to qaqmin/TiebaLite. The two highest-risk tokens — the old GitHub and the old Codeberg — are respectively revoked and awaiting the web-page delete; Codeberg has no revocation API, so that one click belongs to the master alone.

IV. The Accounting of Incident Response

This response leaves three reusable lines of accounting: revocation and replacement are separate acts — retiring the old key is the master hand, onboarding and verifying the new one is the proxy work, and the boundary is clean; authorization is judged from the server side — a dry-run timeout would be misread as failure, while the server API field does not lie; every file-touching step needs its own approval — the lesson of the trojan incident is that unexplained writes are the most dangerous, so the writes that respond to the incident should ask permission at every step. When the rotation closes, the nine repositories of min09577 and qaqmin all stand behind the new key.