fix(keys): correct the key-lifecycle contracts to the measured truth #95

Merged

abiba-bot merged 5 commits from fix/key-expiry-enforcement-20260915 into master 2026-09-15 05:37:46 +00:00

Conversation 0 Commits 5 Files Changed 3

+108 -32

5 Commits

Author	SHA1	Message	Date
root	8a4dd08b05	fix: capture 401/403 response body and key alias for credential faults ... - get_response_body() returns first 200 chars of response body (single line) - On 401/403 model probe: report code + body + key_alias - Monitor key alias: monitor-20260813 (from /etc/litellm-monitor.env on CT 116) - Failed connections stay probe-failed, 200 stays plain 200 - Do not turn other statuses into credential faults Signed-off-by: Abiba	2026-09-15 05:11:07 +00:00
root	88b6decb31	fix: remove false Infisical claim - master key NOT in infrastructure project ... - Replace Infisical retrieval path with proven docker exec + .env note - State explicitly that master key is NOT in Infisical project=infrastructure - Keep the live-key check and never-trust-a-literal instruction - All other corrections from PR #95 preserved Signed-off-by: Abiba	2026-09-15 04:42:31 +00:00
root	7bf9f78fc6	fix: gpu-dense probe timeout handling - report probe-failed with kind, not service verdict ... - probe_http now returns (code, failure_kind) tuple - Model probes report 'probe-failed: <model> <kind> (Ns timeout)' on 000 - Do not assert a service verdict from a failed probe - 30s timeout for single-host aliases (RTX 3090 needs long warmup/prefill) - 60s timeout for syslog-auto pool alias with retry on 000 Signed-off-by: Abiba	2026-09-15 04:22:46 +00:00
root	dd9e68329e	fix: correct infisical --plain flag and use verified localhost:4000 endpoint ... - Replace broken --plain flag (prints nothing on CLI 0.43.110) with awk parsing - Note that --plain is broken so nobody fixes it back - Replace unproven nginx path with verified direct endpoint http://127.0.0.1:4000/key/list Signed-off-by: Abiba	2026-09-15 03:05:30 +00:00
root	cd9ec6a0df	fix: correct key-lifecycle contracts to match measured reality ... - hermes-key-enforcement.prose.md: - State that expiry must be set EXPLICITLY at creation with duration - Record that config default is NOT honoured by LiteLLM 1.99.1 - Describe daily audit as AUDIT-ONLY (reports non-expiring and soon-to-expire) - State that renewal is NOT implemented - Document exclusions: abiba-pi and all crewmate keys stay WITHOUT expiry - koby is report-only - litellm-api-keys.prose.md: - Replace literal master key with retrieval path (docker exec + infisical) - State that literal values must never be trusted again (key rotates) - Add live-key check (200 from /key/list) Signed-off-by: Abiba	2026-09-15 02:59:19 +00:00