diff --git a/bootstrap.yml b/bootstrap.yml
index d66dc0c..c40a328 100644
--- a/bootstrap.yml
+++ b/bootstrap.yml
@@ -169,7 +169,7 @@
       state: directory
       owner: hpf-ans
       group: root
-      mode: ug=rwx,o=
+      mode: u=rwx,go=
 
 # - name: Create ansible-pull.sh crontab entry
 #   become: true
diff --git a/scraps/TODO.txt b/scraps/TODO.txt
index 693c0e7..88cd295 100644
--- a/scraps/TODO.txt
+++ b/scraps/TODO.txt
@@ -4,7 +4,6 @@
 * create production, development branches
 * have bootstrap.sh get ansible_pull_branch variable value
 
-* have bootstrap.yml use ansible.builtin.blockinfile to maintain /etc/skel/.profile
 
 
 
@@ -108,9 +107,4 @@ cron job for ansible-pull
 
 
 use tags to do things like allow selecting software updates, software cleanup, etc.
-ansible_os_family variable
-ansible galaxy
 
-have upgrade pip and ansible in ~hpf-ans/.ansible-venv
-hashicorp vault
-have ansible-pull.sh make sure only one copy is running
\ No newline at end of file