decisions: Time landed on prod; VENICE_API_KEY is the first product secret

docs/decisions.md

@@ -4,7 +4,7 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 
 ## Standing rules
 - Prod is the cloud instance at teahub.xyz. The Mac (hb-5) is the operator's playground and the archive of the old factory; prod never depends on it.
-- No secrets on prod beyond: Gitea's own keys, the GitHub OAuth client, the MCP's OAuth client. Adding one is a decision.
+- No secrets on prod beyond: Gitea's own keys, the GitHub OAuth client, the MCP's OAuth client, and the seat keys listed in the ledger. Adding one is a decision.
 - Every agent acts as itself (its own Gitea login). No service tokens.
 - Port pieces from the old instance only when a card needs them, after reading them, one piece per commit, logged in docs/rebuild.md.
 
@@ -26,3 +26,5 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-14 · **The old Fly edge is down; its sites are dark on purpose.** `teahub-gitea` scaled to zero (app kept, no machines). Dark until ported: persimmons.app, phast.app, phly.cloud, yolopreneur.lol apex/www, supertestnet.lol, notplanned., maths., 🫖, matcha.teahub.xyz. Per-venture `<slug>.yolopreneur.lol` Workers are unaffected. The Mac is now reachable only over the tailnet; the last public wire into it is cut. Port order: persimmons, phast, yolopreneur apex. Why: the edge was the only thing coupling public DNS to the Mac, and nothing behind it had meaningful traffic.
 - 2026-10-14 · **Time moves to prod. GitHub was the proof of concept.** Supersedes the "GitHub is upstream for Time" clause above and the "merge into Time on GitHub" entry: the factory runs on prod Gitea, in one place, with Gitea Actions. `teahubxyz/time` on GitHub becomes read-only once the port lands; no two-way issue sync, ever (Time's state is its issue comments, and a mirrored state machine is a conflict generator). Steps: Fly runner → Gitea backend behind Time's forge module → migrate `time` with issues once → flip workflows to `.gitea/workflows` → archive GitHub copy. Why: Time in one repo host and Teahub in another made no sense; everything on GitHub would defeat standing up Gitea at all.
 - 2026-10-14 · **Runner on Fly: `green-tea-runner`** (act_runner 5.0.0-dind, iad, shared-cpu-2x/4GB, 10GB volume holding Docker's data root — Fly's rootfs is overlay so `/var/lib/docker` must live on the volume). Labels `ubuntu-latest`, `ubuntu-22.04` → `node:22-bookworm`. Registered instance-wide as `fly-iad-1`. Smoke: `teahubxyz/teahub` `.gitea/workflows/smoke.yml` green. Why: Actions on prod are a precondition for Time on prod.
+- 2026-10-14 · **Time landed on prod** (`teahubxyz/time` native, migrated once with issues; port merged as time#47; GitHub copy archived with a pointer). Workflows stay in `.github/` (Gitea reads it). Trust = repo owner, `TIME_TRUSTED` variable, or collaborator, because the Actions token can't read permissions. `venture.py` is not ported yet (time#48); venture loop stays off. Why: see the entry above; one host, no sync.
+- 2026-10-14 · **First product secret on prod: `VENICE_API_KEY`** on `teahubxyz/time` (repo Actions secret; the same key the old factory used, taken from its delivery on hb-5, never printed). With it: `TIME_WORKER=venice:qwen coder`, `TIME_REVIEW=venice:grok`, `TIME_MODE=live`, `TIME_AUTOMERGE=on` (merges only on a trusted Approve + green CI, never on protected paths). Why: seats are the product; the operator said the key lives with Boring's deliveries, and the factory is meant to run without hand-offs.