From b1bd5c861e86279a0e8d5503e84fc35334c867b0 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@novox.be>
Date: Tue, 6 Oct 2026 12:13:57 +0200
Subject: [PATCH] Mark the OpenAI keys letta and supabase hold as issued
 outside the mesh

The controller now replaces a given at-start secret after the module's
first good start and on rotate (hq ADR 0228); a key only OpenAI can
issue must say so, or a fresh random value would take its place.
---
 modules/letta/module.json    | 3 ++-
 modules/supabase/module.json | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/modules/letta/module.json b/modules/letta/module.json
index 8731e65..50013b0 100644
--- a/modules/letta/module.json
+++ b/modules/letta/module.json
@@ -34,7 +34,8 @@
     },
     "openai-api-key": {
       "path": "${dir:state}/openai-api-key.secret",
-      "taken": "at-start"
+      "taken": "at-start",
+      "issued-by": "outside"
     }
   },
   "listens": [
diff --git a/modules/supabase/module.json b/modules/supabase/module.json
index 2b7444a..f72e979 100644
--- a/modules/supabase/module.json
+++ b/modules/supabase/module.json
@@ -44,7 +44,10 @@
     "pooler-vault": "${dir:state}/pooler-vault.secret",
     "key-base-a": "${dir:state}/key-base-a.secret",
     "key-base-b": "${dir:state}/key-base-b.secret",
-    "openai": "${dir:state}/openai.secret"
+    "openai": {
+      "path": "${dir:state}/openai.secret",
+      "issued-by": "outside"
+    }
   },
   "contributes": {
     "route": {