feat: multi-tenant arc (MT-01..MT-05d) + quick wins (TRI-59, TRI-62)

.env.example

@@ -20,16 +20,25 @@ LIBSQL_URL=http://libsql:8080
 BETTER_AUTH_SECRET=CHANGEME
 BETTER_AUTH_URL=http://localhost:3001
 
+# === Envelope encryption for per-tenant integration keys ===
+# 32 bytes, base64 — generate with: openssl rand -base64 32
+# Used by runtime/src/lib/crypto-envelope.ts to wrap per-row DEKs that
+# encrypt project_integrations.encrypted_key. Rotating this key requires
+# re-wrapping every row's DEK; losing it makes stored keys unrecoverable.
+APP_MASTER_KEY=CHANGEME
+
 # === LLM / AI (OpenRouter) ===
 # Get your key at https://openrouter.ai/settings/keys
 OPENROUTER_API_KEY=CHANGEME
 
 # === Integrations ===
 
 # === Integrations: Linear ===
-# Get key at: https://linear.app/agentic-engineering-agency/settings/api
-# Dashboard: https://linear.app/agentic-engineering-agency/team/TRI/all
+# Get key at: your Linear workspace settings → API
+# Team ID: go to your team dashboard → copy the team UUID from the URL
+# Dashboard: https://linear.app/your-workspace/team/YOUR_TEAM_KEY/all
 LINEAR_API_KEY=CHANGEME
+LINEAR_TEAM_ID=645a639b-39e2-4abe-8ded-3346d2f79f9f  # Default: TRI team from agentic-engineering-agency
 GITHUB_TOKEN=CHANGEME             # GitHub PAT for PR comments (repo scope)
 
 # === Integrations: Resend (Email) ===
@@ -46,65 +55,25 @@ SLACK_CHANNEL_ID=CHANGEME
 SLACK_SIGNING_SECRET=CHANGEME
 # Team member Slack user IDs (for @mentions in notifications)
 # Find IDs: click a user profile in Slack → "..." → "Copy member ID"
-SLACK_USER_CHENKO=
 SLACK_USER_FERNANDO=
 SLACK_USER_KOKI=
+SLACK_USER_CHENKO=
 SLACK_USER_LALO=
 
 # === Integrations: Jira ===
 JIRA_BASE_URL=https://your-domain.atlassian.net
 JIRA_EMAIL=your-email@example.com
 JIRA_API_TOKEN=CHANGEME
 
-# === Cloudflare Tunnel ===
-# Token for the triage-hackathon tunnel (routes langfuse.agenticengineering.lat → langfuse-web:3000)
-# Get with: cloudflared tunnel token triage-hackathon
-CLOUDFLARE_TUNNEL_TOKEN=CHANGEME
-
-# === Langfuse Core ===
-# Generate with: openssl rand -hex 32
-ENCRYPTION_KEY=CHANGEME
-SALT=CHANGEME
-NEXTAUTH_SECRET=CHANGEME
-NEXTAUTH_URL=https://langfuse.agenticengineering.lat
-# External URL via Cloudflare Tunnel — used by OpenRouter broadcast and Mastra LangfuseExporter
-LANGFUSE_BASEURL=https://langfuse.agenticengineering.lat
-LANGFUSE_PUBLIC_KEY=CHANGEME
-LANGFUSE_SECRET_KEY=CHANGEME
-TELEMETRY_ENABLED=true
-LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=false
-# URL shown in the frontend "Observability" link in the sidebar.
-# Production (via Cloudflare Tunnel): https://langfuse.agenticengineering.lat
-# Demo / local dev: http://localhost:3000
-# Note: exposed to the browser at build time (VITE_* prefix).
-VITE_OBSERVABILITY_URL=http://localhost:3000
-
-# === Langfuse Infrastructure ===
-# Generate with: openssl rand -hex 32
-CLICKHOUSE_PASSWORD=CHANGEME
-REDIS_AUTH=CHANGEME
-MINIO_ROOT_USER=minio
-MINIO_ROOT_PASSWORD=CHANGEME
-LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
-LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
-LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=CHANGEME
-LANGFUSE_S3_BATCH_EXPORT_ENABLED=false
-
-# === Langfuse Init (Headless Setup — auto-creates org/project/user) ===
-LANGFUSE_INIT_ORG_ID=triage-org
-LANGFUSE_INIT_ORG_NAME=Triage SRE
-LANGFUSE_INIT_PROJECT_ID=triage-project
-LANGFUSE_INIT_PROJECT_NAME=Triage Agent
-LANGFUSE_INIT_PROJECT_PUBLIC_KEY=CHANGEME
-LANGFUSE_INIT_PROJECT_SECRET_KEY=CHANGEME
-LANGFUSE_INIT_USER_EMAIL=admin@agenticengineering.lat
-LANGFUSE_INIT_USER_NAME=Admin
-LANGFUSE_INIT_USER_PASSWORD=CHANGEME
-
-# === Postgres (Langfuse backend DB) ===
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=CHANGEME
-POSTGRES_DB=langfuse
+# === Webhook testing (optional, dev-only) ===
+# scripts/simulate-webhook.sh signs its payloads with HMAC-SHA256. By default
+# it reads the secret from the webhook_secrets table (populated by POST
+# /api/linear/webhook/setup once the webhook is registered with Linear).
+# If you don't have a registered webhook yet — e.g. you're testing locally
+# without ngrok — uncomment and set this to any non-empty string and export
+# it only in the shell that runs simulate-webhook.sh. Do NOT set this in the
+# running runtime's env: the server always reads from the DB.
+# WEBHOOK_SECRET=dev-only-not-a-real-secret
 
 # === Frontend ===
 # Valid values: static (production, serves built SPA) or dev (proxies to Vite HMR)

.mcp.json

@@ -8,6 +8,10 @@
         "@mastra/mcp-docs-server@latest"
       ],
       "env": {}
+    },
+    "linear": {
+      "command": "npx",
+      "args": ["-y", "mcp-remote", "https://mcp.linear.app/mcp"]
     }
   }
 }