From f9a024ce108d050138b92007a916c3d327abb2aa Mon Sep 17 00:00:00 2001 From: jeremy Date: Thu, 20 Aug 2026 15:09:07 -0500 Subject: [PATCH] docs: syn2mas dry-run results and count reconciliation Co-Authored-By: Claude Opus 5 --- docs/superpowers/plans/mas-auth-inventory.md | 29 ++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/superpowers/plans/mas-auth-inventory.md b/docs/superpowers/plans/mas-auth-inventory.md index 2fc7941..e09be76 100644 --- a/docs/superpowers/plans/mas-auth-inventory.md +++ b/docs/superpowers/plans/mas-auth-inventory.md @@ -39,3 +39,32 @@ ssh glyptic@192.168.86.192 'docker exec synapse-db psql -U synapse -d synapse -t ``` Compare against the table above. Device counts may **grow** (new logins) but must not shrink for token-based accounts. + +--- + +## syn2mas dry-run results (2026-08-20 20:07Z) + +`syn2mas check`: **"Check completed successfully with no errors or warnings."** + +Dry-run migration summary (rolled back automatically): + +``` +20 users migrated (0 skipped) + 0 third-party IDs migrated (0 skipped) + 0 upstream links (external IDs) migrated (0 skipped) +53 non-refreshable access tokens migrated (0 skipped) + 0 refreshable token pairs migrated (0 skipped) +53 devices migrated (0 skipped) +``` + +### Reconciliation against the pre-migration baseline + +| Metric | Synapse | syn2mas | Explanation | +|---|---|---|---| +| Users | 20 | 20 | exact match | +| Devices | 65 | 53 | 12 of the 65 are **cross-signing key pseudo-devices** (`display_name like '%signing key%'`), not login sessions. Real login devices = 53. Verified by query. Cross-signing keys stay in Synapse's own e2e tables. | +| Access tokens | 54 | 53 | The one token not migrated is **device-less**, and MAS compat sessions are device-scoped. Identified as `syt_Ym9i_…` — `Ym9i` is base64 for **"bob"**, a leftover token from the decommissioned `@bob` agent, attached to `@spirit`. Last validated months ago. | + +**Spirit is safe:** its configured `accessToken` (`syt_c3Bpcml0…`, base64 `c3Bpcml0` = "spirit") maps to device `CEBHTAXUAY`, which migrates. Verified by joining the config token against `access_tokens`. + +**Conclusion: go.** No account loses a credential it actually uses.