Skip to content

fix(deploy): persist Sluice gateway secret bridge - #524

Merged
JustAGhosT merged 3 commits into
devfrom
agent/durable-sluice-gateway-secret
Jul 14, 2026
Merged

fix(deploy): persist Sluice gateway secret bridge#524
JustAGhosT merged 3 commits into
devfrom
agent/durable-sluice-gateway-secret

Conversation

@JustAGhosT

@JustAGhosT JustAGhosT commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • add an optional COGMESH_SLUICE_API_KEY fallback in the API deploy workflow while keeping the preferred COGMESH_SLUICE_API_KEY_SECRET_URI Key Vault path
  • update the NeuralLiquid migration handoff and verification record with the 2026-07-14 Docket/Sluice production closeout
  • record Sluice gateway key rotation, Key Vault reference resolution, and Docket ingestion smoke evidence

Changes

  • API deploy workflow can use Key Vault URI first, direct Sluice secret only as a fallback, and deletes stale Sluice app settings when neither source exists
  • migration docs now route remaining transfer work to Baton Migration Coordinator, Evidence and Claims Auditor, and FinOps/Runway Analyst as appropriate
  • migration docs now mark Docket ingestion smoke and Sluice Key Vault wiring complete

Related Issues

  • NeuralLiquid Cognitive Mesh migration / Batch 2 handoff

Architecture Layer

  • CI/CD and migration documentation only; no runtime code path changes

Checklist

  • Sluice Key Vault reference configured for production and staging
  • Docket ingestion smoke verified through CogMesh production and Docket logs
  • Temporary direct Sluice GitHub secret removed after Key Vault wiring
  • Remaining org/OIDC/secrets/DNS transfer work preserved in verification checklist

Test Plan

  • git diff --check
  • CogMesh production and staging /api/v1/sluice/health report status=configured, sluiceConfigured=true, directProviderFallbackAllowed=false, docketConfigured=true
  • Azure config-reference status for production and staging SLUICE_API_KEY is Resolved
  • authenticated Sluice /v1/models returns HTTP 200 with configured routes after key rotation
  • CogMesh production POST /api/v1/docket/usage returned HTTP 202 for correlation codex-smoke-20260714134919
  • Docket production logs show POST /usage/model-events returned HTTP 200 at 2026-07-14T11:49:50Z

Screenshots

  • Not applicable; workflow and documentation changes only

Notes

  • .serena/ remains local agent state and is not included

Summary by CodeRabbit

  • Bug Fixes
    • Improved staging and production deployments so Sluice API authentication works whether credentials come from a direct key or a Key Vault secret reference.
    • Prevented outdated Sluice API settings from persisting when no valid Sluice credential is configured.
  • Documentation
    • Updated migration/verification notes with the latest handoff and refresh status, including recent deploy outcomes, health checks, and remaining transfer steps.

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your trial has ended. Reactivate Greptile to resume code reviews.

@qodo-code-review

Copy link
Copy Markdown

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@JustAGhosT, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: da02f5f4-71e2-4536-93cb-495f3ef59955

📥 Commits

Reviewing files that changed from the base of the PR and between 602d3cd and fccd340.

📒 Files selected for processing (1)
  • docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md
📝 Walkthrough

Walkthrough

The deployment workflow now supports a direct Sluice API key secret for staging and production when a Key Vault URI is unavailable. Migration handoff and verification documents record deployment results, health checks, and remaining transfer tasks.

Changes

Sluice deployment and migration closeout

Layer / File(s) Summary
Sluice key deployment handling
.github/workflows/deploy.yml
Staging and production inject COGMESH_SLUICE_API_KEY, use it when the Key Vault URI is absent, and remove SLUICE_API_KEY when neither source is configured.
Migration closeout and verification records
docs/migrations/2026-neuralliquid-cognitive-mesh/handoff.md, docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md
Migration records document the July 14 closeout refresh, deployment and health-check results, operational caveats, and remaining transfer checklist.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubSecrets
  participant DeployWorkflow
  participant AppService
  GitHubSecrets->>DeployWorkflow: Provide COGMESH_SLUICE_API_KEY
  DeployWorkflow->>DeployWorkflow: Select Key Vault URI or direct secret
  DeployWorkflow->>AppService: Configure SLUICE_API_KEY
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title is concise and matches the main change: adding a temporary Sluice secret bridge in deploy.
Description check ✅ Passed The description covers summary, changes, checklist, test plan, and screenshots, matching the template well.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch agent/durable-sluice-gateway-secret

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md`:
- Around line 9-11: Update the Batch 2 closeout status in the migration
verification document so the repository transfer work and remaining
org/OIDC/secrets/DNS and Docket smoke-test checklist are explicitly routed to
the specified Baton specialists, following the applicable path instructions.
Preserve the existing transfer-blocked status and prerequisites.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e76c1bcf-582b-4918-8fe0-e78eadd9a411

📥 Commits

Reviewing files that changed from the base of the PR and between eac1d23 and 885f95f.

📒 Files selected for processing (3)
  • .github/workflows/deploy.yml
  • docs/migrations/2026-neuralliquid-cognitive-mesh/handoff.md
  • docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md

Comment thread docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md`:
- Around line 143-146: Update the “Remaining Before Transfer” checklist to
explicitly include Baton FinOps and Runway Analyst verification of
cost-attribution readiness as a required gate. Assign the OIDC
federated-credential, secrets, environments, app-installation, and
DNS/custom-domain tasks to the appropriate Baton specialist, while preserving
the existing deployment and Terraform prerequisites.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 31b66141-f997-47e4-8d3f-9e14e6a363b0

📥 Commits

Reviewing files that changed from the base of the PR and between 885f95f and 602d3cd.

📒 Files selected for processing (3)
  • .github/workflows/deploy.yml
  • docs/migrations/2026-neuralliquid-cognitive-mesh/handoff.md
  • docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • docs/migrations/2026-neuralliquid-cognitive-mesh/handoff.md
  • .github/workflows/deploy.yml

Comment thread docs/migrations/2026-neuralliquid-cognitive-mesh/verification.md Outdated
@JustAGhosT
JustAGhosT merged commit 7da496b into dev Jul 14, 2026
5 checks passed
@JustAGhosT
JustAGhosT deleted the agent/durable-sluice-gateway-secret branch July 14, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant