hobbs-iac/docs/superpowers/plans/mas-auth-inventory.md

Matrix Auth Inventory — baseline before MAS migration

Captured 2026-08-20 from /var/lib/synapse/homeserver.db (SQLite, pre-migration).

Totals: 20 users (7 deactivated), 65 devices, 54 access tokens, 9 e2e device key entries.

Per-account baseline

Account	Devices	Tokens	Password hash	Credential location	Auth style
@jeremy	12 (incl. cross-signing keys)	3	yes	user-typed (bigdog01)	password + Element sessions
@clippyauto	17	17	yes	n8n credential store (encrypted, /home/node/.n8n/database.sqlite on .100)	repeated password login — new device per login
@pluto	15	15	yes	unknown (OpenClaw Gateway devices)	repeated password login
@julie	5	2	yes	Element X Android	password
@spirit	2	3	yes	/mnt/infrastructure/spirit/openclaw.json → key accessToken only	access token
@margaret	2	2	yes	/mnt/infrastructure/margaret/openclaw.json → keys accessToken and password	token + password
@frigate	2	2	yes	compose/hf-pdocker-01/frigate-notify/.env → MATRIX_ACCESS_TOKEN=syt_ZnJpZ2F0…	access token
@alertbot	2	2	yes	/mnt/docker-data/configs/alertmanager/matrix-receiver-config.yml → token: "syt_YWxlcnRib3Q…"	access token
@hermes	2	2	yes	unknown	unknown
@fry	1	1	yes	unknown	unknown
@testbot	1	1	yes	TESTBOT_CI device	unknown
@admin1, @adminuser	2 each	2 each	yes	unknown	admin accounts
@aaron, @bob, @clippy, @travis, @tempadmin, @resetadmin, @resetadmin2	0	0	none	—	deactivated

Risk read

• Access-token accounts (spirit, frigate, alertbot) are the safest: syn2mas imports access tokens, so they should continue uninterrupted.
• @clippyauto and @pluto are the canaries. The 1:1 device-to-token ratio and high counts mean they authenticate with a password on each connect, creating a fresh device every time. Post-migration they exercise the MAS compatibility layer (/_matrix/client/*/login proxied to MAS). If the bcrypt unicode_normalization: true scheme is misconfigured, these break first and loudest — @clippyauto polls every ~2s, so failure is visible within seconds.
• @jeremy's 12 devices include cross-signing keys (master/self_signing/user_signing), not just sessions. Cross-signing state must survive or Element will prompt to re-verify.

Post-migration verification command

ssh glyptic@192.168.86.192 'docker exec synapse-db psql -U synapse -d synapse -tc "
 select u.name,
        (select count(*) from devices d where d.user_id=u.name) dev,
        (select count(*) from access_tokens a where a.user_id=u.name) tok
 from users u where u.deactivated=0 order by u.name;"'

Compare against the table above. Device counts may grow (new logins) but must not shrink for token-based accounts.