pdurlej/platform

Fork 0

docs(secrets): add infisical key map and agent sos #606

Closed

codex wants to merge 0 commits from codex/m03-infisical-key-map into main

codex commented

2026-05-29 15:53:38 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Adds a metadata-only Infisical key map and Agent SOS guide so cousin agents can find secret paths without guessing or asking Piotr for raw credentials.

Canary Context Pack

Product story

Agents currently treat Infisical as a black box. That creates repeated confusion, wrong-path guesses, and unnecessary operator interruptions. This gives them a safe map: path names, key names, refresh time, and escalation shapes only.

What changed

Added docs/infisical/key-map.md with path families, key names, refresh metadata, and maintenance rules.
Added docs/agents/agent-sos.md for secret/identity/Forgejo access triage.
Linked both from runbooks/secrets-pipeline.md.

Why it changed

The platform needs a shared, non-secret map of where secrets live and how agents should report blockers. Key names are safe evidence; values remain outside git.

Files touched

docs/infisical/key-map.md
docs/agents/agent-sos.md
runbooks/secrets-pipeline.md

Relevant context

M03 secrets/access hardening
runbooks/secrets-pipeline.md
docs/forgejo-agent-operations.md
Infisical Agent Onboarding skill

Runtime evidence

Metadata-only Infisical refresh was run for known platform paths. It recorded key names and counts only. No secret values were printed or stored.

Known constraints

This is not an automated inventory yet. Two documented paths are marked unverified because this Token Auth identity did not return readable key names for them during refresh.

Explicit out-of-scope

No secret value changes.
No Infisical ACL changes.
No automatic platformctl secrets map command yet.
No Vault/BWS migration.

Requested decision

Merge as docs-only M03 friction reduction.

Merge blockers

Any key name that should not be documented even as metadata.
Any concern that FORGEJO_ADMIN_PAT_TEMP should be removed before documenting its existence.

Spec sources read

runbooks/secrets-pipeline.md - primary secrets runbook
docs/forgejo-agent-operations.md - Forgejo/Infisical operational rules
/Users/pd/.codex/skills/infisical-agent-onboarding/SKILL.md - local cousin secret-handling contract

Validation

UV_CACHE_DIR=/private/tmp/uv-cache-platform PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json - exitCode 0, 88 modules ok
Infisical metadata-only refresh: key names/counts only; no values printed or committed

Canary status: missing - fire canary 3+3 manually before merge ## Summary Adds a metadata-only Infisical key map and Agent SOS guide so cousin agents can find secret paths without guessing or asking Piotr for raw credentials. ## Canary Context Pack ### Product story Agents currently treat Infisical as a black box. That creates repeated confusion, wrong-path guesses, and unnecessary operator interruptions. This gives them a safe map: path names, key names, refresh time, and escalation shapes only. ### What changed - Added `docs/infisical/key-map.md` with path families, key names, refresh metadata, and maintenance rules. - Added `docs/agents/agent-sos.md` for secret/identity/Forgejo access triage. - Linked both from `runbooks/secrets-pipeline.md`. ### Why it changed The platform needs a shared, non-secret map of where secrets live and how agents should report blockers. Key names are safe evidence; values remain outside git. ### Files touched - `docs/infisical/key-map.md` - `docs/agents/agent-sos.md` - `runbooks/secrets-pipeline.md` ### Relevant context - M03 secrets/access hardening - `runbooks/secrets-pipeline.md` - `docs/forgejo-agent-operations.md` - Infisical Agent Onboarding skill ### Runtime evidence Metadata-only Infisical refresh was run for known platform paths. It recorded key names and counts only. No secret values were printed or stored. ### Known constraints This is not an automated inventory yet. Two documented paths are marked unverified because this Token Auth identity did not return readable key names for them during refresh. ### Explicit out-of-scope - No secret value changes. - No Infisical ACL changes. - No automatic `platformctl secrets map` command yet. - No Vault/BWS migration. ### Requested decision Merge as docs-only M03 friction reduction. ### Merge blockers - Any key name that should not be documented even as metadata. - Any concern that `FORGEJO_ADMIN_PAT_TEMP` should be removed before documenting its existence. ## Spec sources read - `runbooks/secrets-pipeline.md` - primary secrets runbook - `docs/forgejo-agent-operations.md` - Forgejo/Infisical operational rules - `/Users/pd/.codex/skills/infisical-agent-onboarding/SKILL.md` - local cousin secret-handling contract ## Validation - `UV_CACHE_DIR=/private/tmp/uv-cache-platform PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` - exitCode 0, 88 modules ok - Infisical metadata-only refresh: key names/counts only; no values printed or committed

codex added 1 commit

2026-05-29 15:53:38 +02:00

docs(secrets): add infisical key map and agent sos

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 22s

Details

patchwarden-pr-sanity / sanity (pull_request) Failing after 1m51s

Details

81c611a8bb

pdurlej referenced this pull request from a commit

2026-05-29 15:54:55 +02:00

Merge pull request #606 from codex/m03-infisical-key-map

pdurlej commented

2026-05-29 15:55:19 +02:00

Owner

Manually integrated because Forgejo checks stayed pending while the change is docs-only and local validation was green.

Integrated on main via merge commit e7863e34a34e78658c09fd050138b99db1038487.

Validation summary:

platformctl validate all --json: exitCode 0, 88 modules ok
Infisical refresh was metadata-only: path/key names and counts only, no values printed or committed

Manually integrated because Forgejo checks stayed pending while the change is docs-only and local validation was green. Integrated on `main` via merge commit `e7863e34a34e78658c09fd050138b99db1038487`. Validation summary: - `platformctl validate all --json`: exitCode 0, 88 modules ok - Infisical refresh was metadata-only: path/key names and counts only, no values printed or committed

pdurlej closed this pull request

2026-05-29 15:55:19 +02:00

codex referenced this pull request

2026-05-29 16:49:43 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237