[holmboe]

Why

Dynatron's standup page calls user.whoami and maniphest.search with PHAB_TOKEN, and on the local Phorge that is the admin's phabfive-dev token, which can do anything. It only needs to read.

What

• A new seed module, dynatron (needs auth), creates a bot account dynatron: isSystemAgent, not an admin, no password, no memberships. It has a permanent command line Conduit token, PHORGE_DYNATRON_TOKEN in k8s/base/secret.env, with the same fallback default in the module and in phorge/lib/banner.sh.
• The token is made by the code that made the admin's, moved from auth.php into PhabfiveSeedModule::ensureConduitToken(): tokenName where the release has it, no expiry, and an existing token with an expiry made permanent. It also refuses a token value that already belongs to another account, so two variables set to the same value cannot hand one account's token to the other.
• make creds and the startup banner print Dynatron's token, labelled as Dynatron's, when the instance has it (PHORGE_SEED may leave the module out).
• Docs: the bot account under What Gets Created, the settings table, the module table, and the in-cluster clients section, which now says Dynatron uses this token rather than the admin's. CHANGELOG under Other Notes.

Tests

• tests/k8s/test_seed.py: the user exists, is a bot and not an admin; its token answers user.whoami as dynatron and reads the same maniphest.search results as the admin; a second seed run creates and changes nothing; and test_api_token_never_expires now covers both tokens.
• tests/e2e/test_cli.py: phabfive user whoami and maniphest search with Dynatron's token.
• Locally on stable: make test-k8s 44 passed, make test-e2e 151 passed (2 skipped), unit tests 6416 passed.
• Labelled ci:phorge-stable and ci:phabricator-stable so CI seeds it on both, rather than switching the shared local instance to Phabricator.

🤖 Generated with Claude Code