aygea
fd8e8cbbd7
- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident - CURRENT_STATE / TODO / CHANGELOG / TRIALS - trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output) - docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF - handoffs: TEMPLATE + 2026-10-19 initial-install record
25 lines
1.4 KiB
Markdown
25 lines
1.4 KiB
Markdown
# Trial: mcode endpoint / key pairing
|
||
|
||
- **Date:** 2026-10-19
|
||
- **Question / hypothesis:** the SecretVault secret `zai_api_key` (plain 48–49 char
|
||
string) is the direct z.ai API key, not the `vault.itsaygea.com` proxy clientKey;
|
||
therefore the statusline should default to `https://api.z.ai`.
|
||
- **Scope / acceptance:** three HTTP probes return codes consistent with exactly one
|
||
pairing per key; no key material printed.
|
||
- **Inputs / environment:** host `mewtwo` (Ubuntu, PVE), curl with `--max-time 8`,
|
||
key fetched via `secretvault run --secret zai_api_key -- bash -c 'printf %s "$zai_api_key"'`;
|
||
legacy key from `~/.secretvault/credential.json` (`.clientKey`, 51 chars).
|
||
- **Procedure:**
|
||
```bash
|
||
# codes only; -o /dev/null -w '%{http_code}'
|
||
vault-key @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit
|
||
vault-key @ https://api.z.ai/api/monitor/usage/quota/limit
|
||
cred-key @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit
|
||
```
|
||
- **Expected vs observed:** expected one 200; observed
|
||
`401 (vault@proxy) / 200 (vault@zai) / 200 (cred@proxy)`.
|
||
- **Verdict:** confirmed — vault key is the direct z.ai credential; proxy clientKey is
|
||
separate. `zai-usage.sh` implements vault→`api.z.ai` first, credential.json→proxy fallback.
|
||
- **Repeat guard:** revisit if the vault secret is rotated to a proxy clientKey, or if
|
||
`api.z.ai` starts rejecting it (401 after rotation).
|