---
id: resolve-key-version-redundancy
name: Resolve client_secrets KeyVersion Redundancy
status: completed
depends_on: []
scope: narrow
risk: low
impact: isolated
level: implementation
---

## Description

W07: `client_secrets` has both a standalone `keyVersion` column (integer NOT NULL DEFAULT 1) AND `keyVersion` embedded in the `value` JSONB (`EncryptedData.keyVersion`). These can diverge with no documented invariant.

Either remove the standalone column (read from `value.keyVersion`), or document that the standalone column is authoritative and must be kept in sync with the JSONB value.

## Acceptance Criteria

- [ ] Decision documented: remove standalone column OR document authoritative source
- [ ] If keeping standalone: add invariant that standalone column and `value.keyVersion` are always in sync
- [ ] `services.md` updated to reflect the decision
- [ ] `table-reference.md` updated if column is removed

## References

- docs/reviews/storage-architecture-review-2026-04-21.md#W07
- docs/architecture/storage/services.md:71, :82-86

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion