# Session Summary + Reusable Playbook (Azure Staging, Secrets Hygiene, Abuse Controls)

> **Audience:** Agents working on MindLyst/LysnrAI repos (or any BytelystAI repo) who need a repeatable checklist.
> **Scope:** Staging hardening (Azure + repo guardrails) + basic OpenAI endpoint abuse controls.
> **Last updated:** 2026-02-14

---

## What We Did (This Repo)

### 1. Documented Current Azure Staging Inventory (No Secret Values)

- Consolidated the “what exists / what to create” story into a single portal runbook:
  - `docs/WINDSURF/AZURE_PORTAL_SETUP.md`
- Ensured docs do **not** contain secret values.
- Standardized on **Key Vault as source of truth**:
  - Vault: `kv-mywisprai`
  - Secret prefix: `mindlyst-*` for MindLyst, `lysnr-*` for LysnrAI (legacy: `wispr-*`)
- Added a “generate `.env.local` from Key Vault” snippet (for local dev) and kept `.env.local` gitignored.

Staging resources (shared RG, legacy names kept):

- Resource Group: `rg-mywisprai`
- Cosmos DB account: `cosmos-mywisprai` (DBs: `mywisprai`, `mindlyst`)
- Storage account: `bytelystblobs` (containers: `mindlyst-voice`, `mindlyst-images`, `mindlyst-exports`)
- Azure OpenAI (AI Foundry): `mywisprai-openai-sweden` (deployment: `gpt-4o-mini`)
- Speech: `mywisprai-speech`
- Key Vault: `kv-mywisprai` (secrets: `mindlyst-*`, `lysnr-*` (legacy: `wispr-*`))
- Notification Hub namespace: `lysnnai` (hub: `mindlyst-hub`)
- App Insights: `bytelyst-appinsights`

### 2. Centralized Secrets + Created Rotation Roadmap (Rotation Deferred, But Tracked)

- Added/updated the rotation runbook:
  - `docs/WINDSURF/AZURE_KEY_VAULT_AND_SECRETS_ROTATION.md`
- Captured the key point for all agents:
  - Even if secrets are now in Key Vault, if they ever appeared in git history, treat them as compromised and rotate ASAP.
- Rotation is intentionally deferred, but the doc includes a checkbox backlog and runbooks per service.

### 3. Added Guardrails So Secrets Don’t Land In Git Again

Scripts:

- Staged-diff scan (blocks commits): `scripts/secret-scan-staged.sh`
- Tracked-file scan (blocks pushes / quick checks): `scripts/secret-scan-repo.sh`

Git hooks (Husky):

- `.husky/pre-commit` runs `scripts/secret-scan-staged.sh` and then `lint-staged`
- `.husky/pre-push` runs `scripts/secret-scan-repo.sh`

Repo hygiene:

- `.gitignore` updated to ignore common key/cert formats: `*.pem`, `*.p12`, `*.pfx`, `*.key` (and env files).
- Manual CI docs + quick checks include secret scanning:
  - `MANUAL_CI.md`
  - `quick-check.sh`

### 4. Added “Beta Launch Readiness” Tracker

- Added/updated:
  - `docs/WINDSURF/BETA_LAUNCH_READINESS.md`
- This separates “verified locally” vs “still required” items (auth, hosting, KV integration, monitoring/alerts, backups).

### 5. Added Basic Abuse Controls For Azure OpenAI-Backed Routes (Web)

Documentation:

- `docs/WINDSURF/WEB_ABUSE_CONTROLS.md`

Implementation:

- Shared helper: `mindlyst-native/web/src/lib/abuse.ts`
  - In-memory fixed-window rate limiting (429 + `Retry-After` + `X-RateLimit-*` headers)
  - Field-size guard (413)
- Protected routes:
  - `mindlyst-native/web/src/pages/api/triage.ts`
  - `mindlyst-native/web/src/pages/api/brain-chat.ts`
- Added per-route body parser cap:
  - `export const config = { api: { bodyParser: { sizeLimit: "64kb" }}}`
- Added env knobs (documented in `docs/WINDSURF/WEB_ABUSE_CONTROLS.md` and listed in `docs/WINDSURF/AZURE_PORTAL_SETUP.md`):
  - `RATE_LIMIT_ENABLED`
  - `LLM_RATE_LIMIT_WINDOW_MS`
  - `TRIAGE_RATE_LIMIT_LIMIT`
  - `BRAIN_CHAT_RATE_LIMIT_LIMIT`
  - `TRIAGE_MAX_CONTENT_CHARS`
  - `BRAIN_CHAT_MAX_MESSAGE_CHARS`
  - `BRAIN_CHAT_MAX_HISTORY_MESSAGES`
  - `BRAIN_CHAT_MAX_HISTORY_TOTAL_CHARS`

Known limitation (explicitly documented):

- This limiter is **per instance** (in-memory). For multi-instance/serverless scale-out, move to Redis/Upstash/provider-native limiting.

### 6. IaC To Replicate Shared RG In A Different Subscription/Account

- Bicep template:
  - `infra/azure/bytelyst-shared/main.bicep`
- Deployment guide:
  - `infra/azure/bytelyst-shared/README.md`
- Compiled ARM is tracked intentionally for diffs:
  - `infra/azure/bytelyst-shared/main.json`

---

## Reusable Playbook (Apply To Other Repos)

Use this as a checklist for a new repo or a repo that accidentally leaked secrets.

### A. Secrets Hygiene (Do This First)

- [ ] Inventory all secrets the repo uses (Cosmos, Storage, OpenAI, Speech, Notification Hub, App Insights, Stripe, etc.).
- [ ] Create/choose an Azure Key Vault per environment (`kv-<env>`).
- [ ] Pick canonical secret names (prefix by product): `mindlyst-*`, `lysnr-*`, etc.
- [ ] Move secret **values** into Key Vault.
- [ ] Remove secret **values** from:
  - [ ] Markdown docs
  - [ ] `.env*` files
  - [ ] source code
  - [ ] CI logs / README examples
- [ ] If a secret ever landed in git history:
  - [ ] Treat it as compromised
  - [ ] Rotate it (do not delay for “later cleanup”)

### B. Guardrails (Prevent Regressions)

- [ ] Add `.gitignore` entries:
  - [ ] `.env`, `.env.local`, `.env.*.local`
  - [ ] `*.pem`, `*.p12`, `*.pfx`, `*.key`
- [ ] Add staged secret scanning (commit blocker):
  - [ ] `scripts/secret-scan-staged.sh`
  - [ ] Hook it via Husky `.husky/pre-commit` (or pre-commit framework)
- [ ] Add tracked-file scanning (push blocker):
  - [ ] `scripts/secret-scan-repo.sh`
  - [ ] Hook it via `.husky/pre-push`
- [ ] Add a manual “quick check” that includes secret scanning:
  - [ ] Update `quick-check.sh` (or equivalent)
  - [ ] Update `MANUAL_CI.md` if CI is disabled

### C. Basic Abuse Controls For Any LLM Routes (Denial-of-Wallet Protection)

- [ ] Identify every route that calls an LLM provider (Azure OpenAI/OpenAI/etc.).
- [ ] Add request body caps:
  - [ ] In Next.js API routes: `export const config = { api: { bodyParser: { sizeLimit: "64kb" }}}`
- [ ] Add rate limiting:
  - [ ] Prefer per-user (requires auth)
  - [ ] Fallback: per-IP (+ optional `x-user-id` like we do here)
- [ ] Add field-level guards:
  - [ ] max message/content chars
  - [ ] max history length and total chars
- [ ] Document defaults + env knobs in a single doc (so the next agent knows what’s enforced).
- [ ] For production / multi-instance:
  - [ ] Replace in-memory rate limiting with Redis/Upstash or platform-native rate limiting

### D. Beta Readiness Tracking

- [ ] Create a single “go/no-go” checklist doc (one page) and keep it current:
  - [ ] Verified checks (lint/build/tests, secret scan)
  - [ ] Remaining blockers (auth, hosting, KV integration, monitoring, backups)

---

## Quick Commands (Local Agent Workflow)

```bash
# Secret scan (tracked files)
bash scripts/secret-scan-repo.sh

# Web verification (MindLyst)
cd mindlyst-native/web
npm run lint
npm run build

# Key Vault list (staging)
az keyvault secret list --vault-name kv-mywisprai --query "[].name" -o tsv
```
