Rotate keydates PATs (models:read + data bot)

[sparkyfen]

Tracking issue for the two Sparky-owned fine-grained PATs used by the key-dates automation. GitHub has no native issue reminders, so this issue is the durable tracker; when the PATs are created, add a scheduled workflow (or droplet cron) that comments here ~2 weeks before expiry so it surfaces in notifications.

The tokens

PAT	Permissions	Lives	Expires
keydates-models	account-level Models: read, no repo access	droplet, worker env file (chmod 600)	TBD - fill in at creation
keydates-data-bot	consfyi/data Contents + Pull requests write	droplet, worker env file / git credential file	TBD - fill in at creation

Rotation runbook

1. Create the replacement PAT in GitHub settings (same scopes, new expiry).
2. Swap it into the droplet env/credential file; chmod 600.
3. Verify: worker DRY_RUN=1 --series eurofurence exits 0 (models PAT); GH_TOKEN=<new> gh api repos/consfyi/data --jq .permissions shows push: true (data PAT).
4. Revoke the old PAT.
5. Update the expiry column above and the reminder schedule.

While you're here

• Confirm telegram_dry_run is in the intended state.
• Check /health and recent bot PR cadence look normal.

Context: HANDOFF-keydates.md / CHANGE-keydates-deploy.md in Sparky's workspace.

[sparkyfen]

PATs created and deployed 2026-07-09 (key-dates automation is live on the droplet as of tonight):

PAT	Resource owner	Scope	Expires	Lives
keydates-models	sparkyfen	no repo access; Models: read	never — no deadline reminder possible, rotation is manual-discipline only	droplet env file (GITHUB_TOKEN), chmod 600
keydates-data-bot	consfyi	consfyi/data only; Contents + PRs R/W	2027-07-09	droplet env file (GH_TOKEN), chmod 600 + git credential setup

Scope verified at deploy: data-bot PAT 404s on private repos outside its grant; models PAT returns 200 on a 1-token completion. Rotation steps: create new → swap value in the env file on the box → verify with a worker DRY_RUN=1 --series run + a gh api repos/consfyi/data probe → revoke old. Set a calendar reminder ~2 weeks before 2027-06-25; the pre-expiry comment cron from the original spec is still TODO.