Rotate Railway / Cloudflare / ext-scores tokens pasted during 2026-07-05 incident recovery

[wallscaler]

Railway, Cloudflare, and ext-scores tokens were pasted in-session during the 2026-07-05 incident recovery and are slated for rotation.

Checklist:

• Rotate Railway API token
• Rotate Cloudflare API token
• Rotate ext-scores token: update BOTH publisher and read env AND the cathedral-sat-poster worker secret EXT_TOKEN (all three must move together or the poster 401s)
• Confirm the CF poster still posts after rotation (watch /v1/external-scores status freshness)

[wallscaler]

Partial rotation done (2026-07-05).

• CATHEDRAL_V2_SUBMIT_TOKEN_SECRET rotated — this was the actual exposed secret (came back plaintext in a Railway variables query this session). Generated a fresh 48-byte token, set on v2-beta AND v2-worker (they must match; verified the token is minted+verified within v2-beta and the worker only reads it), redeployed both, confirmed submit path healthy. Old secret is dead. New secret stored at ~/Documents/TOOLS/.credentials/cathedral-v2-submit-token-secret. In-flight tokens (TTL 300s) minted with the old secret 401'd for ~5 min then self-healed on miner re-fetch.

Still needs Fred (dashboard actions I can't do via API):

• Railway API token (1c81b550-..., pasted in-session) — must create a new token in the Railway dashboard and revoke the old. I can't create dashboard tokens via API. Once you create it, drop it in ~/Documents/TOOLS/.credentials/railway and I'll re-verify access.
• Cloudflare API token — same, dashboard action.
• ext-scores token — 3-way move: publisher env + read env + the cathedral-sat-poster worker secret EXT_TOKEN. I can do the two env sides via Railway; the CF worker secret needs your wrangler/CF auth. Say the word and I'll stage the Railway sides so you only have to do the worker secret + confirm the poster still posts.

Note: this session used the pasted Railway token heavily to fix the live outage; rotating it is good hygiene but not urgent since it's stored chmod 600 and wasn't exposed in output.