0 Fork 0

Files

T

aygea fd8e8cbbd7 docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

2026-10-19 23:25:21 -07:00

1.4 KiB

Raw Permalink Blame History

Trial: mcode endpoint / key pairing

Date: 2026-10-19
Question / hypothesis: the SecretVault secret zai_api_key (plain 48–49 char string) is the direct z.ai API key, not the vault.itsaygea.com proxy clientKey; therefore the statusline should default to https://api.z.ai.
Scope / acceptance: three HTTP probes return codes consistent with exactly one pairing per key; no key material printed.
Inputs / environment: host mewtwo (Ubuntu, PVE), curl with --max-time 8, key fetched via secretvault run --secret zai_api_key -- bash -c 'printf %s "$zai_api_key"'; legacy key from ~/.secretvault/credential.json (.clientKey, 51 chars).

Procedure:

# codes only; -o /dev/null -w '%{http_code}'
vault-key  @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit
vault-key  @ https://api.z.ai/api/monitor/usage/quota/limit
cred-key   @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit

Expected vs observed: expected one 200; observed 401 (vault@proxy) / 200 (vault@zai) / 200 (cred@proxy).
Verdict: confirmed — vault key is the direct z.ai credential; proxy clientKey is separate. zai-usage.sh implements vault→api.z.ai first, credential.json→proxy fallback.
Repeat guard: revisit if the vault secret is rotated to a proxy clientKey, or if api.z.ai starts rejecting it (401 after rotation).

1.4 KiB Raw Permalink Blame History Unescape Escape

Trial: mcode endpoint / key pairing

1.4 KiB

Raw Permalink Blame History