From b0b4381c8738fe93eeb1fcea5023114eaa1c08b7 Mon Sep 17 00:00:00 2001
From: sam-dembrane <sam-dembrane@sam2ks-MacBook-Pro.local>
Date: Tue, 14 Jul 2026 11:04:09 +0200
Subject: [PATCH] feat(infra): wire NOTION_API_KEY + POSTHOG_API_KEY secrets,
 stage ATTIO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the two new keys the operator provisioned to the config.yaml
secrets map — Terraform creates the Secret Manager resources,
upload-secrets.sh pushes the values from .env, and the CI deploy
composes them into Cloud Run --set-secrets. Sessions inherit the
daemon's env (session.py env=os.environ.copy()), so $NOTION_API_KEY /
$POSTHOG_API_KEY are usable from session bash the deploy after the
secrets exist. Both names contain KEY, so the PR #139 redactor scrubs
them from outbound posts.

ATTIO_API_KEY is staged but commented in both files: no key exists yet,
and mounting a versionless secret fails the Cloud Run revision.

Deploy order (documented in-file): terraform apply + upload-secrets.sh
BEFORE merging this — merging first would deploy a mount for secrets
that don't exist yet.

.env.example also gains the missing EXA_API_KEY line (drift since
PR #72).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .env.example      |  8 ++++++++
 infra/config.yaml | 12 ++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.env.example b/.env.example
index 8510631..db359c2 100644
--- a/.env.example
+++ b/.env.example
@@ -9,6 +9,14 @@ GITHUB_TOKEN=github_pat_...        # Fine-grained PAT, scoped to Dembrane repos
 # Linear
 LINEAR_API_KEY=lin_api_...
 
+# Integrations (optional — skip any you don't use; upload-secrets.sh skips
+# empty values, and the runtime treats each as absent when unset)
+EXA_API_KEY=...                    # Exa web search (exa-search skill)
+NOTION_API_KEY=ntn_...             # Notion internal-integration token (PR #126 skills)
+POSTHOG_API_KEY=phx_...            # PostHog personal API key (product analytics queries)
+# ATTIO_API_KEY=...                # Attio CRM — also commented in infra/config.yaml;
+                                   # uncomment both once a key is provisioned
+
 # Google Cloud / Vertex AI (required for ADK runner)
 GOOGLE_CLOUD_PROJECT=...           # GCP project ID
 GOOGLE_CLOUD_LOCATION=eu           # Used ONLY by the dormant Claude path.
diff --git a/infra/config.yaml b/infra/config.yaml
index 0677279..1b66e2a 100644
--- a/infra/config.yaml
+++ b/infra/config.yaml
@@ -74,3 +74,15 @@ secrets:
   # public edge proxy in functions/ does NOT read this; it only adds an IAM
   # identity. Optional at runtime: unset → daemon doesn't expose /github/webhook.
   GITHUB_WEBHOOK_SECRET: GITHUB_WEBHOOK_SECRET
+  # Notion internal-integration token for the Dembrane workspace. Consumed by
+  # the Notion client/capability/skills shipping in PR #126; usable from
+  # session bash (`$NOTION_API_KEY`) as soon as it's mounted.
+  NOTION_API_KEY: NOTION_API_KEY
+  # PostHog personal API key — lets sessions query analytics, error tracking,
+  # and session-replay metadata for the product (Dembrane/echo).
+  POSTHOG_API_KEY: POSTHOG_API_KEY
+  # ATTIO_API_KEY: ATTIO_API_KEY
+  #   ^ plumbing prepared but deliberately commented out: no Attio key exists
+  #   in .env yet, and mounting a secret that has no version fails the Cloud
+  #   Run revision at deploy. Uncomment, then `terraform apply` +
+  #   `upload-secrets.sh`, once the operator provisions an Attio API key.