Part of #525. From the BYOK security audit (follow-up to #664/#665).
createdBy is persisted on POST /ai-key (src/api/routes.ts, src/db/repositories.ts) but never read back, and there is no audit event when a key is set, replaced, or deleted. A maintainer/operator can't tell who set or removed a repo's provider key or when.
Fix: surface createdBy/updatedAt in getRepositoryAiKeyStatus (row already has them) and emit a recordAiUsageEvent (feature ai_key_change, status set|replace|delete, actor=createdBy, no key material) on upsert/delete. Test: audit event written with no key material; status returns actor/timestamp.
Severity: medium.
Part of #525. From the BYOK security audit (follow-up to #664/#665).
createdByis persisted onPOST /ai-key(src/api/routes.ts, src/db/repositories.ts) but never read back, and there is no audit event when a key is set, replaced, or deleted. A maintainer/operator can't tell who set or removed a repo's provider key or when.Fix: surface
createdBy/updatedAtingetRepositoryAiKeyStatus(row already has them) and emit arecordAiUsageEvent(featureai_key_change, statusset|replace|delete, actor=createdBy, no key material) on upsert/delete. Test: audit event written with no key material; status returns actor/timestamp.Severity: medium.