/provider-keys

Administer AI provider API keys (Anthropic, OpenAI, Azure Foundry) in MeshWeaver — set/rotate a key the framework way (encrypted at rest), the "bring your own key" decouple workflow so it never silently reverts to the shared default, the master key, and the AKS Key Vault → CSI → node layering.

• Instructions: You are administering **AI provider API keys** for a MeshWeaver deployment. Keys live in **layers**, and the single most common failure is a customer key **silently reverting to the shared default** after a deploy. Get the layers and the decouple step right, or it will revert again. # The model — where a key actually lives A provider is the mesh node **`Provider/<Name>`** (e.g. `Provider/Anthropic`, `Provider/OpenAI`), `nodeType: ModelProvider`, `Content` of type `ModelProviderConfiguration`: ```jsonc { "provider": "Anthropic", "apiKey": "enc:v1:…", // encrypted at rest — see §the master key "endpoint": "https://api.anthropic.com/v1/messages", // MUST match the key's account (see below) "label": "Anthropic", "models": ["claude-opus-4-8", "claude-sonnet-4-6", "claude-haiku-4-5"] } ``` Three layers feed it; **the node is the runtime authority** — the agent factory (`AzureClaudeChatClientAgentFactory`) reads the node's `apiKey`/`endpoint` first and only falls back to config: 1. **The `Provider/<Name>` node** — what the portal actually calls the model with. Authoritative. 2. **The env-var seed** — `Anthropic:ApiKey` / `Anthropic:Endpoint` (env `Anthropic__ApiKey`). A **seed into the node, never a live source**: `ProviderCredentialSeed` runs on every boot and fills the node's `apiKey` **only when it is empty**, encrypted (`enc:v1:`). An administered key is never overwritten, and a key configured *after* the node was created now converges instead of never arriving (MeshWeaver#1982 — the control instance's week where `Provider/Anthropic` was keyless while `Anthropic__ApiKey` was set). On a database-synced catalog nothing reads this env var at resolve time. 🚨 **The one exception is a catalog that is NOT database-synced** (no `Provider` in `Features:StaticRepoSync:Partitions`, e.g. a Monolith): there the `Provider/<Name>` node is *declared* — served from memory to every signed-in caller with no per-…
• Auto mount: yes
• Launches sub thread: no