Relay outbox

Rules for whoever posts: post the text exactly as written, as a comment or new issue in the target named; never edit code; never merge; never post secrets or client data; report each link back.

ID	Status	Target	Type	Text to post
R1	POSTED 13 Oct 00:35 by the API agent (issue in moneymarche/api)	GitLab moneymarche/api (new issue)	Issue	Title: Move the /save-nav API_KEY into configuration and script its rotation. Body: From Ajay (MMDEP doc, 12 Oct): the key is hard-coded in src/config.py (API) and lambda/navdata/lib/navdata.py (mm-crons). Atul's decision (12 Oct): (1) first list every job and service that uses this key or the database credentials (API, Lambda, crons, staging) and show how each will read them after the change; (2) change the code in both repos to read the key from configuration (environment or a config file outside git), behaviour otherwise unchanged; (3) add a rotation script that generates a new key, writes it to the API config and the Lambda configuration, restarts the API, and checks the Lambda run; (4) prove on staging that every job still reaches the database and the API before production. One MR per repo, no key values anywhere. The API restart takes about 1 minute and the Lambda runs at 15:30, so the rotation avoids that time. Relates to API !156, API !111 and MM-Cron !77. Decision: Atul via MMDEP-PM.
R2	POSTED 13 Oct 00:35 by the API agent (issue in moneymarche/mm-crons)	GitLab moneymarche/mm-crons (new issue)	Issue	Title: Staging and production share mm_data: treat staging writes as production. Body: From Ajay (MMDEP doc, 12 Oct): the WordPress databases differ, but mm_data is common to staging and production. Until Ajay confirms whether staging jobs can write to mm_data, no staging run may write to it. Check MM-Cron !71 and !73 (fail-closed staging policy and preflight guard) against this and say whether they cover mm_data. Decision: MMDEP-PM.
R3	POSTED 13 Oct 00:35 by the API agent	GitLab moneymarche/api (comment on API !111)	Comment	Atul's decision (12 Oct): database credentials follow the same pattern as the /save-nav key (see the new issue from relay R1): inventory of every job that uses them, code reads them from configuration, a rotation script, and a staging check that every job still reaches the database before production. Ajay notes the WordPress databases differ between staging and production while mm_data is shared, so the inventory must say which credentials each job uses. This MR's plan can be closed or updated to point to that issue.
R4	PENDING (for MWMC, next PROCEED)	GitLab money-marche-testing/money-marche-sandbox (new issue, labels project::mmclone, security)	Issue	Title: Install a valid SSL certificate on mmclone.arevalifestyle.com. Body: MMCLONE is reachable only over http (Atul, 13 Oct: the certificate couldn't be set up). Correction (Atul, 13 Oct): MMCLONE is http://mmclone.arevalifestyle.com, a subdomain created inside the Bluehost account of the otherwise blank domain arevalifestyle.com (no separate DNS); fix SSL through Bluehost AutoSSL or Let's Encrypt for that subdomain. Plan the fix: the hosting's AutoSSL or Let's Encrypt for the subdomain (DNS and vhost first), HTTP-to-HTTPS redirect, then confirm the staging SEO guards (noindex, robots, sitemap 410, canonical to the clone host) still hold over https. Steps that change the server need Atul; write them as a support-release issue. The MMDEP collector checks the certificate hourly and will show when it is valid. Decision: Atul via MMDEP-PM.
R5	PENDING (for the MMDEP assistant or API agent; owner MMDEP)	GitHub moneymarche-dev/MMDEP (new issue)	Issue	Title: Certificate renewal for all Money Marche domains, before expiry. Body: Atul (13 Oct): we need a job that renews SSL certificates for all our domains before they expire. Already in place: the MMDEP collector checks expiry hourly for moneymarche.com, www, api, stgapi, mmclone and wpdev and flags any certificate within 21 days of expiry. To do: (1) domain list (from GoDaddy, 13 Oct): moneymarche.com hosts @, www, api, app, crm, dev, mautic, staging, stgapi (Lightsail 65.2.119.188); wpdev, mail, portfolio-engine-dev (Bluehost 162.214.80.21); dashboard (CNAME to beta.my-planner.in, an outside domain: confirm it is ours); MMCLONE lives at mmclone.arevalifestyle.com (Bluehost). Other domains: arevalifestyle.com (Bluehost),: policymarche.com, fintechshala.com, pitchskore.com, partywarez.com. Domain auto-renew is off for all five; partywarez.com expires 22 Nov 2026; (2) for each, record where the certificate is issued (Lightsail/Bitnami bncert or certbot, Bluehost AutoSSL, other) and whether auto-renewal is on; (3) turn on auto-renewal where missing (server step by a person, as a runbook); (4) the collector alert goes to the MMDEP Actions panel 21 days ahead. Decision: Atul via MMDEP-PM.