Issue 268: letta printed its passwords into its log #126

2026-10-06T00:15:16Z

mesh-admin commented

2026-10-06 00:15:16 +00:00

New issue record (status located). It covers the symptom with no values, the cause (letta prints LETTA_PG_URI and its secure-mode password, the module put the DB password in that URI, and nothing compared a container's log with its secrets), the fix (mesh-catalog fix/letta-secrets-out-of-logs, mesh-controller feat/rotate-one-consuming-module), the rotation steps that need operator approval, and how it was checked.

records.py, index.py and cycle.py pass. The record uses role names only.

New issue record (status located). It covers the symptom with no values, the cause (letta prints LETTA_PG_URI and its secure-mode password, the module put the DB password in that URI, and nothing compared a container's log with its secrets), the fix (mesh-catalog fix/letta-secrets-out-of-logs, mesh-controller feat/rotate-one-consuming-module), the rotation steps that need operator approval, and how it was checked. records.py, index.py and cycle.py pass. The record uses role names only.

mesh-admin added 1 commit 2026-10-06 00:15:17 +00:00

Issue 268: letta printed its passwords into its log f6f5563de2

Record the leak, its cause, the fix and the rotation steps the operator
approves once the fix runs, so the exposed secrets are replaced in order.

mesh-admin merged commit 3e55277aa9 into main

2026-10-06 00:25:33 +00:00

mesh-admin deleted branch issues/268-letta-printed-its-passwords

2026-10-06 00:25:33 +00:00

mesh-admin commented

2026-10-06 23:07:09 +00:00

Delivery novox/hq@3e55277aa950 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/hq#126 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@3e55277aa950` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/hq#126 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#126