[mashkovd]

Summary

• Enable DEMO_REVIEWER_ENABLED (password-gated reviewer login as demo account 8745115872, no phone/SMS) for the ChatGPT App Directory review.
• Add labs-mctl-telegram-demo ExternalSecret from Vault secret/data/platform/mctl-telegram/demo (username + PASSWORD key → DEMO_REVIEWER_PASSWORD) and wire via envFrom.
• Image already at 0.35.0 (auto-bumped); this only turns the feature on.

Test plan

• ExternalSecret labs-mctl-telegram-demo syncs (no SecretSyncedError)
• pod healthy (no CrashLoop from missing DEMO_REVIEWER_PASSWORD)
• tg.mctl.ai/oauth/authorize shows the reviewer login form
• Disable + rotate password after the review

[claude]

Claude finished @mashkovd's task in 1m 14s —— View job

---

Values-only YAML change: env vars, envFrom reference, and an ExternalSecret definition consistent with the existing secrets in this file. Credentials are sourced from Vault; no plaintext secrets. The asymmetric Vault key name (PASSWORD → DEMO_REVIEWER_PASSWORD) is documented inline. Comments and the test plan both call out the required post-review cleanup (disable flag, rotate password, remove Vault secret).

0 P1 / 0 P2 / 0 P3 findings — good to merge.

[claude]

Claude finished @mashkovd's task in 1m 4s —— View job

---

Review

• Read changed files and diff
• Analyze for correctness, security, and operational safety
• Post review findings

---

Config/values YAML only. No P1 or P2 findings.

• Secrets are correctly sourced from Vault via ExternalSecret — no plaintext credentials.
• DEMO_REVIEWER_TG_ID hardcoded as an env var is fine; Telegram user IDs are not sensitive.
• ExternalSecret pattern matches the existing entries in the file.
• Comments document the removal obligation clearly (Turn OFF and rotate the password after the review).

One P3 note: the Vault property names (DEMO_REVIEWER_USERNAME, DEMO_REVIEWER_PASSWORD) must exactly match the keys seeded in secret/data/platform/mctl-telegram/demo — if Vault was seeded with shorter names like USERNAME/PASSWORD the ExternalSecret will silently fail to populate the env vars and the pod will crash. Worth verifying the Vault secret was seeded with those exact key names before merging (the test plan item "ExternalSecret syncs" will catch this).

No P1/P2 findings, good to merge.