[stackptr]

This rotates the two oMLX sub-keys that the retired shared home agenix key could decrypt. That key was also on lobtop, which is employer-managed, and oMLX is reachable from the internet at models.zx.dev, so anyone holding an old sub-key could use the models from anywhere.

What changed

• home/secrets/aichat-env.age and hosts/glyph/secrets/opencode-env.age hold new oMLX sub-keys, one per consumer, in STROMA_API_KEY.
• I checked the headers of both files: aichat-env is encrypted to glyph, Rhizome, Stroma and both YubiKeys, and opencode-env to glyph and both YubiKeys. Every .age file in the repo matches its rule (0 mismatches, none orphaned).
• home/secrets/claude-code-api-key.age is deleted. Nothing has read it since fix(home): clean up Claude Code config and expand permissions #406, and its key has been revoked at Anthropic.
• otel-token is unchanged. It is lobtop's own token, so the shared key being on lobtop exposed nothing new.

After merging

1. Deploy glyph, then switch Rhizome and Stroma.
2. Check aichat on Rhizome or Stroma, and opencode-web on glyph.
3. Delete the old two sub-keys in oMLX. Until then they still work.

---

Generated by Claude Code