Old ~/.config/credentials deleted on the operator's go (R-1134 closed); R-1130 accepted; R-1138 for its two backup copies (176 rows)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2026-10-17 — `~/.config/credentials` deleted (R-1134)
+
+The operator's go, after every key in it was checked equal in the CC store. `read_credential.py`, `fb_probe.py` and
+`bench/README.md` say so; no behaviour change (`--credentials` still reads a given file).
+
 ## 2026-10-17 — the CC secret broker `sec` replaces `~/.config/credentials` for CC (R-1118, R-1122)
 
 The tool itself lives in the private repo `admin/cc-secrets` (its own CHANGELOG). Here: the consumers.

scripts/bench/README.md

@@ -31,8 +31,8 @@ lifetime total. Use watts × time for energy.
 When the plug moves address or is paired again: re-run the tinytuya wizard in `~/.config/felhom-bench/`
 (credentials `TUYA_ID`, `TUYA_SECRET`, `TUYA_DEVICE_ID`, region `eu`) and update `plug.json`. Its output prints the
 key — send it to a file, never to a terminal or a log. The credentials belong in the CC secret store and are used
-through `sec run TUYA_ID,TUYA_SECRET,TUYA_DEVICE_ID -- …` (`admin/cc-secrets`); **they are not in the store yet** —
-the old `~/.config/credentials` did not hold them either on 2026-10-17 (R-1118 build).
+through `sec run TUYA_ID,TUYA_SECRET,TUYA_DEVICE_ID_N100,TUYA_DEVICE_ID_HP -- …` (`admin/cc-secrets`; the operator added
+them 2026-10-17, and a read-only cloud status call through `sec run` passed for both plugs).
 
 ## plugswitch.py — switch the N100's plug (`on`, `off`, `status`)
 

scripts/facebook/fb_probe.py

@@ -15,7 +15,7 @@ There is deliberately NO "post for real" sub-command: real posting belongs to th
 from this spike's findings (audits/SPIKE-facebook-page-api-2026-10-08.md).
 
 SECRETS. The token comes from the CC secret store — run `sec run FACEBOOK_API -- python3 fb_probe.py …` — or,
-until the old file retires, from ~/.config/credentials (key FACEBOOK_API); no flag takes one.
+from a file given with --credentials (the old ~/.config/credentials was deleted 2026-10-17); no flag takes the token.
 It travels as `Authorization: Bearer`, never in a logged URL (the one query-string carrier,
 debug_token's input_token, is never printed: -v prints the path without its query). Every saved
 response passes redact(): every `access_token` key is dropped and any string carrying a held token

scripts/read_credential.py

@@ -2,7 +2,8 @@
 """Read ONE value out of ~/.config/credentials, correctly, and refuse loudly when it is not.
 
 SUPERSEDED 2026-10-17 by `sec` (the CC secret store, `admin/cc-secrets` ARCHITECTURE.md): use
-`sec run NAME -- <command>`. This reader keeps working until the old file retires (R-1118 follow-up).
+`sec run NAME -- <command>`. ~/.config/credentials was DELETED on 2026-10-17 on the operator's go (R-1134), after
+every key in it was checked equal in the store; this reader now has nothing to read unless given --credentials.
 
 Run:  python3 scripts/read_credential.py <KEY> <OUTFILE> [--credentials PATH]
       (OUTFILE is where the value GOES — a temp file. It is refused if it is the credentials file itself.)