decisions: token receipt (35, 36)

docs/decisions.md

@@ -41,3 +41,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-14 · **SKILLS.md is the skills contract**, the third root file beside `AGENTS.md` (how to move here) and `DESIGN.md` (what good looks like): routes (task → one to three skills, named by path), a ledger (upstream ref and tree, version, what each skill writes) and belts (⬜ admitted, 🟩 katas beat no-skill on a named seat, ⬛ grown from our traces, 💤 retired once a seat no longer needs it). Skills are never left to auto-trigger, and no model decides which skill to load. `.agents/skills/README.md` now points to it and AGENTS.md has the move. (The first skills README said Claude Code reads `.agents/skills/`; it reads `.claude/skills/` only.) Why: the Oct 14 skills research — unaided triggering fires about half the time, generic skills often add nothing on strong models, and the trust that holds comes from gates (evals, pinned refs, sandboxes), not prose. Time's seats are plain API calls, so routing has to live in a file every seat can read (#7).
 - 2026-10-14 · **phast and persimmons re-ported from their canonical repos; phast runs.** The port above copied `tea-mcp/src` snapshots from Oct 9, older than the canonical `matcha/phast` and `matcha/persims`. So phast.app came up in the old light design and persimmons.app on a holding page. Both canonical repos are now merged, with history, into `phast/app` and `persimmons/app`, and their trees are the canonical ones. **phast**: Fly app `phast-app` (1 machine, volume `phast_data`) serves phast.app, my.phast.app and `*.phast.app` from that one repo: the pages are its `index.html` and `my/index.html`, and the MCP at `my.phast.app/mcp` signs in with Teahub OAuth. The OAuth app is "Phast app", owned by `teahubxyz`, redirect `https://my.phast.app/auth/callback`; the client secret and JWT key exist only as Fly secrets and were never printed. `ALLOWED_GITEA_USERS=matcha,chai`. matcha's Phast app moved from hb-5. Closes phast/app#1. **persimmons**: pages serves persimmons.app from `persimmons/app`'s root (its `pages/page.conf` says `source=.`). The API isn't on prod, so the vault reads "Service unavailable". persimmons/app#1 covers the port, including whether a product backend may hold an admin-scoped token: it creates vault repos and stores PATs as Actions secrets. `phast/site`, `persimmons/site` and `persimmons/extension` are archived with pointers. Pages now serves extensionless HTML (`/signin`) as text/html. Why: the regression was a stale copy, so each product ships from the one repo its owner works in.
 - 2026-10-14 · **The portfolio lists the operator's own products too, and phly.cloud is back.** Teahub, Persimmons, Phly, Phast app, MacMCP and Time join the ledger at yolopreneur.lol (25 entries). They are listed like well-known.online: `url` is the product's own address, `ventures/<slug>/index.html` forwards `<slug>.yolopreneur.lol` there, and a first-screen shot (960×600) sits beside it. phly.cloud had been dark since the edge went. Its site, `matcha/phly` with history, is now org `phly`, repo `phly/site`, served by pages (cert issued, DNS moved, push webhook). The favicon pointed at an expired Boring blob link and is now the mascot itself. Still dark and not listed: supertestnet.lol, unicorn.ceo, and the `*.teahub.xyz` sites (maths, notplanned, dreams, oracle, greentea); their bytes are on hb-5 (`~/sites`, the old Gitea). Why: the operator asked for the products in the list; one list, same card for everything.
+- 2026-10-14 · **Receipt: temporary admin tokens for the phast/persimmons/phly work.** `teahubxyz` token 35 (`fix-phast-20261014`, minted on the Fly box for the pushes, the OAuth app and the repo archives) was deleted by id at 22:27 UTC, and the table listing shows only 25 (`time`). Token 36 (`receipt-20261014`) was minted only to push this line, then deleted the same way. Neither was printed. Why: the rule above.