feat(memory): wire optional Qdrant API key end-to-end#3549
Merged
Conversation
Add `api_key: Option<&str>` to `QdrantOps::new` and mirror it through `EmbeddingStore::new` and all three `SemanticMemory` constructors (~40 call sites updated atomically). The key is consumed by the qdrant-client builder and never stored on `QdrantOps`, so no structural leak is possible. Key design decisions: - `MemoryConfig::qdrant_api_key: Option<Secret>` — uses existing `zeph_common::secret::Secret` (Zeroizing + redacted Debug + no Serialize), matching `claude_api_key` / `openai_api_key` precedent - Vault resolution: extends `Config::resolve_secrets` via `ZEPH_QDRANT_API_KEY`, matching `ZEPH_DATABASE_URL` precedent - Init wizard prompts for the key but writes vault instructions instead of persisting plaintext to config.toml - `is_qdrant_localhost` uses `url::Url::host_str()` (handles IPv6 bracket form `[::1]` correctly) to suppress false-positive WARN logs on localhost deployments - Migration step 39 added (no-op: field has `#[serde(default)]`) Closes #3543
github-actions
Bot
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api_key: Option<&str>toQdrantOps::new, mirrored throughEmbeddingStore::newand all threeSemanticMemoryconstructors (~40 call sites)MemoryConfig::qdrant_api_key: Option<Secret>— uses existingzeph_common::secret::Secret(Zeroizing + redacted Debug, no Serialize), matchingclaude_api_keyprecedentZEPH_QDRANT_API_KEYkey, extendingConfig::resolve_secrets(matchesZEPH_DATABASE_URLpattern)tracing::warn!when Qdrant URL is non-localhost and no API key is configured#[serde(default)]); bothMIGRATIONS.len() == 39assertions updatedis_qdrant_localhostusesurl::Url::host_str()for correct IPv6 bracket handlingTest plan
cargo nextest run --workspace --lib --bins— 8683 tests passcargo +nightly fmt --check— cleancargo clippy --workspace -- -D warnings— cleanQdrantOps::newapi_key paths (3 tests),is_qdrant_localhostvariants (2 tests)ZEPH_QDRANT_API_KEYin vault against authenticated Qdrant instance — see playbook at.local/testing/playbooks/qdrant-api-key.mdCloses #3543