Mark the OpenAI keys letta and supabase hold as issued outside the mesh

The controller now replaces a given at-start secret after the module's first good start and on rotate (hq ADR 0228); a key only OpenAI can issue must say so, or a fresh random value would take its place.
2026-10-06 12:13:57 +02:00
parent aabc8aa039
commit b1bd5c861e
2 changed files with 6 additions and 2 deletions
@@ -34,7 +34,8 @@
    },
    "openai-api-key": {
      "path": "${dir:state}/openai-api-key.secret",
-      "taken": "at-start"
+      "taken": "at-start",
+      "issued-by": "outside"
    }
  },
  "listens": [