curriculum-project-hub/.scratch/saas-production-readiness/issues/43-implement-org-connection-secret-plane.md

Implement the Organization connection and secret plane

Type: task Status: open Blocked by: none

Question

Implement encrypted, versioned, Organization-scoped Feishu Application and model Provider Connection records plus one resolver boundary. Support one customer-owned Feishu app per Organization, Organization-admin-managed BYOK, and one distinct platform-managed key/base URL per Organization; enforce which administrator may write each mode, readiness and rotation lifecycle, runtime resolution from Organization/Project, redacted observability, backup/key recovery hooks, and no process-global credential fallback or plaintext leakage into business rows, logs, HTTP responses, or agent environments.