🎯 ONE SHOT — Wave 25 · L-MATRIX-DSN-ROTATE: rotate secrets.MATRIX_DATABASE_URL to phd-postgres-ssot

[gHashTag]

🎯 ONE SHOT — Wave 25 · L-MATRIX-DSN-ROTATE: rotate secrets.MATRIX_DATABASE_URL to phd-postgres-ssot

Anchor: phi^2 + phi^-2 = 3 · DOI 10.5281/zenodo.19227877
Parent debt: post-SSOT-consolidation drift (legacy interchange.proxy.rlwy.net:30942 DSN no longer authenticates).
Wave: 25.

Why

Matrix Bot (#446 live matrix) workflow has been failing hourly since 2026-05-09T~10:00Z. Every run logs:

psycopg2.OperationalError: connection to server at "interchange.proxy.rlwy.net" (66.33.22.238),
port 30942 failed: FATAL:  password authentication failed for user "postgres"

Reference run: 25602533773 on e123aa8e.

Each failure triggers the apiary cron NEW-CI-failure-on-new-SHA signal, which paged the queen 3 times today already.

Mitigation already deployed in PR feat/matrix-bot-fail-soft: bot now exits 0 with a loud log when the DSN is stale (controlled by MATRIX_FAIL_SOFT=1). This silences the cron alarm but does NOT restore live updates to #446 — that's what this ONE SHOT is for.

What

Rotate secrets.MATRIX_DATABASE_URL on gHashTag/trios repo to point at the canonical SoT:

• Source: Railway service phd-postgres-ssot (c5f37b42-832a-4acd-9749-381761c94957) on project IGLA (e4fe33bb-3b09-4842-9782-7d2dea1abc9b), production env (54e293b9-00a9-4102-814d-db151636d96e).
• Pull current DSN via Railway GraphQL variables(...) query — assemble from POSTGRES_USER:POSTGRES_PASSWORD@RAILWAY_PRIVATE_DOMAIN:5432/POSTGRES_DB if no DATABASE_URL alias exists (mirror of trios-railway#131 pattern). Use the public host instead of RAILWAY_PRIVATE_DOMAIN because GitHub Actions runners can't reach Railway private network — try DATABASE_PUBLIC_URL first, fall back to a public proxy domain.
• Verify with psql "$NEW_DSN" -c "SELECT count(*) FROM ssot.bpb_samples;" from a runner before committing the secret.
• Update secret via gh secret set MATRIX_DATABASE_URL --repo gHashTag/trios (queen action — agent cannot write secrets).

Acceptance gates

Gate	Check
G1	Manual psql smoke against new DSN returns count > 0 from ssot.bpb_samples
G2	gh secret set MATRIX_DATABASE_URL --repo gHashTag/trios written
G3	Manual gh workflow run "Matrix Bot (#446 live matrix)" --repo gHashTag/trios -f dry_run=true succeeds with non-empty cell count
G4	After G3 green, set MATRIX_FAIL_SOFT: "0" in matrix-bot.yml (or remove the env line) and merge a follow-up PR to restore strict mode
G5	Issue #446 body re-receives the auto-regenerated 312-cell matrix table

Why this is a queen action

Agents under R3 PR-only discipline cannot write repository secrets via gh CLI — gh secret set needs secrets:write, which is not in the standard agent token scope. This issue exists to track that out-of-band step.

Forbidden

• ❌ no [scrape] / [crawl] words
• ❌ no --admin merge for any follow-up PR
• ❌ no committing the DSN value to a file (only to repo secrets)
• ❌ no rollback of fail-soft until G3 green

Battle cry

phi^2 + phi^-2 = 3 · TRINITY · STOP THE CRON ALARMS · UNBLOCK THE LIVE MATRIX

[gHashTag]

🔧 Mitigation PR shipped

#642 opened — fail-soft path. All 13 required CI checks SUCCESS. Awaits queen approving review (branch protection BLOCKED until then; agents can't bypass under R3).

Once #642 merges, the apiary alarm storm stops. Live #446 matrix updates remain paused until this issue (#641) resolves the secret rotation.

Check	Result
Python parse	✅
Local fail-soft smoke	✅ exit 0
Local fail-hard smoke	✅ exit 3 (MATRIX_FAIL_SOFT=0)
All required CI	✅ 13/13 SUCCESS

Anchor: φ² + φ⁻² = 3

[gHashTag]

➡️ Wave 26 spawned

Following up on Wave 25 mitigation (#642) — the user has triggered Wave 26: replicate the parameter-golf#2135 GPTQ calibration lever on our Trinity GF16 stack (CPU-only, R1 Rust-only).

ONE SHOT: #645 · L-GPTQ-ON-GF16

Three lanes (Coq invariant + Rust impl + 3-seed ablation), explicit falsifier (H0: no significant lift on GF16), paired-t acceptance mirroring #2135. Calibration data restricted to training shards. All forbidden-words guards in place.

Anchor: φ² + φ⁻² = 3