Everything I could decide myself is decided. What's left needs
you. Each one has a recommendation from Fable — if you agree, pick it and
press Done. "I'm not sure" is a real answer and becomes work for me.
You don't need to open the session — pressing Done sends your answer back and it picks up.
1A literal password for the MFA-exempt smoke@propflowai.co account is committed in two repo files, and staff-domain sign-ins are coerced to admin. Rotate now, or confirm it is already dead?
Fable recommends: Treat as compromised: rotate the smoke@ password now, move it to a secret, strip both literals in one PR I verified the literal 'SmokeTest123!' at scripts/stress-common/auth.ts:228 and e2e/auth.setup.ts:18 for smoke@propflowai.co, which auth.ts:210 marks MFA-exempt sitewide (ADR-0069, no TOTP) and which CLAUDE.md says is admin-coerced like every @propflowai.co session. What I could NOT verify is whether the live prod password is actually that string — checking would mean attempting a sign-in I should not attempt. Standard handling is to treat a committed literal for a possibly-live admin account as compromised until rotation is verified. Found while working the UI round; not caused by it and outside its scope. Tried first, unsuccessfully: f50bfd7e8 — both passes independently chose escalate; auto-escalated anyway because the question touches a credential commitment, which Fable does not settle. Its reasoning: the harness targets prod sign-in endpoints, so the account exists in prod on a publicly reachable surface, and 'unverified whether it matches' is the reason to rotate rather than a reason to wait.