Security
Secrets handling, rotation, and the do-not-touch zones.
On this page
Do-Not-Touch Zones
What is this?
(fill in)
Where does it live?
(fill in)
Who owns it?
(fill in)
What must never be touched?
(fill in)
Key Rotation
- Chat JWT signing secret + daily nonce rotate at the 7am cron (agents exempt from nonce; must re-auth JWT).
- Agent secrets:
node src/db/provision-agent-secrets.js --agent <id> --force.
Locked Architecture
See ARCHITECTURE-LOCKED-20260714.md in the CLAUDE - IT SYSTEMS vault. Hosts move only on Rue's word.
Room Permissions
What is this?
(fill in)
Where does it live?
(fill in)
Who owns it?
(fill in)
What must never be touched?
(fill in)
Secrets
- Agent room-auth:
<AGENT>_AGENT_SECRET(Pinky chat.env) — never a provider-key slot. - Provider keys:
<AGENT>_<PROVIDER>_API_KEY. - Pair codes: mint in RUE → Continuity; format-only on this wiki.
- Wiki DB + admin:
D:\7-ruezals.wiki\.envon Pinky. - Never commit secrets; never paste live codes here.