Mark the OpenAI keys letta and supabase hold as issued outside the mesh #89

2026-10-06T10:15:57Z

mesh-admin commented

2026-10-06 10:15:57 +00:00

Per novox/hq ADR 0228 (hq PR #131): letta's openai-api-key (at-start) and supabase's openai now say "issued-by": "outside", so the controller never replaces them with a value it makes.

Merge only after the mesh-controller PR of the same branch is deployed — the current controller's strict parser refuses the unknown field.

Other outside-issued keys (telegram tokens, cloudflare/jira/confluence/gitlab/home-assistant tokens, de-spiegel smtp) say no taken, so they are not rotated either way; marking them is tidying for later.

Per novox/hq ADR 0228 (hq PR #131): letta's `openai-api-key` (at-start) and supabase's `openai` now say `"issued-by": "outside"`, so the controller never replaces them with a value it makes. **Merge only after the mesh-controller PR of the same branch is deployed** — the current controller's strict parser refuses the unknown field. Other outside-issued keys (telegram tokens, cloudflare/jira/confluence/gitlab/home-assistant tokens, de-spiegel smtp) say no `taken`, so they are not rotated either way; marking them is tidying for later.

mesh-admin added 1 commit 2026-10-06 10:15:58 +00:00

Mark the OpenAI keys letta and supabase hold as issued outside the mesh b1bd5c861e

The controller now replaces a given at-start secret after the module's
first good start and on rotate (hq ADR 0228); a key only OpenAI can
issue must say so, or a fresh random value would take its place.

mesh-admin merged commit 12569ed085 into main

2026-10-06 10:27:22 +00:00

mesh-admin deleted branch feat/a-given-secret-lives-until-the-first-good-start

2026-10-06 10:27:22 +00:00

mesh-admin commented

2026-10-06 23:08:18 +00:00

Delivery novox/mesh-catalog@12569ed08564 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds letta, supabase → ace; no bus step

tier 0: letta, supabase
ace: receives letta, supabase
supabase keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#89 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@12569ed08564` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds letta, supabase → ace; no bus step - tier 0: letta, supabase - ace: receives letta, supabase - supabase keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#89 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#89