fix(infisical): allow host Python secret reads without httpx #361

Merged

pdurlej merged 1 commit from codex/honcho-infisical-stdlib-fallback into main

2026-05-18 08:02:38 +02:00

codex commented

2026-05-18 08:00:39 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

The Honcho Ollama runtime bridge must work from RS2000's host Python, not only from a developer venv. After #360 merged, the documented Token Auth env render stopped before any secret write because host Python lacked httpx.

What changed

Added stdlib urllib fallback paths for Infisical Universal Auth login and raw secret reads when httpx is unavailable.
Kept httpx as the preferred path when installed.
Added tests proving login and secret read still work without httpx.

Why it changed

Runtime setup commands in runbooks/honcho-ollama-gemma-switch.md run under host Python on RS2000. Requiring an undeclared host package would force ad-hoc package installation during a cutover. The helper should fail on auth/ACL issues, not on local Python packaging.

Files touched

control-plane/platformctl/secrets/infisical.py
control-plane/platformctl/tests/test_infisical_cache.py

Relevant context

PR #360 added the Token Auth provider env bridge for /home-platform/providers:OLLAMA_CLOUD_API_KEY.
RS2000 release-root already had #360, but sudo PYTHONPATH=control-plane python3 ... write_canary_env.py --backend token-auth failed with InfisicalAuthError: httpx required.

Runtime evidence

RS2000 pre-write attempt failed before secret read/output: InfisicalAuthError: httpx required.
No provider env file was written.
Error report contained no secret values.

Known constraints

This does not widen any Infisical ACL.
A real 403 after this PR remains an ACL problem for the Token Auth identity.
This does not deploy Honcho or restart Honcho services.

Explicit out-of-scope

Installing Python dependencies on RS2000.
Changing Infisical token scopes.
Retrying Honcho deploy before this lands on release-root.

Requested decision

Merge so RS2000 release-root can render the Honcho provider env file using host Python without ad-hoc package installation.

Merge blockers

Secret values appearing in errors/logs.
Fallback changing the existing httpx behavior when httpx is available.
Weakening token file permission checks.

Spec sources read

control-plane/platformctl/secrets/infisical.py — Infisical secret read implementation.
control-plane/platformctl/tests/test_infisical_cache.py — existing token/auth tests.
runbooks/honcho-ollama-gemma-switch.md — runtime command that exposed the host Python dependency gap.

Test Plan

python3 -m py_compile control-plane/platformctl/secrets/infisical.py control-plane/platformctl/ci/write_canary_env.py
control-plane/.venv/bin/python -m pytest -q control-plane/platformctl/tests/test_infisical_cache.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
ruff check control-plane/platformctl/secrets/infisical.py control-plane/platformctl/tests/test_infisical_cache.py control-plane/platformctl/ci/write_canary_env.py
git diff --check

Commit: 43254a2

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story The Honcho Ollama runtime bridge must work from RS2000's host Python, not only from a developer venv. After #360 merged, the documented Token Auth env render stopped before any secret write because host Python lacked `httpx`. ### What changed - Added stdlib `urllib` fallback paths for Infisical Universal Auth login and raw secret reads when `httpx` is unavailable. - Kept `httpx` as the preferred path when installed. - Added tests proving login and secret read still work without `httpx`. ### Why it changed Runtime setup commands in `runbooks/honcho-ollama-gemma-switch.md` run under host Python on RS2000. Requiring an undeclared host package would force ad-hoc package installation during a cutover. The helper should fail on auth/ACL issues, not on local Python packaging. ### Files touched - `control-plane/platformctl/secrets/infisical.py` - `control-plane/platformctl/tests/test_infisical_cache.py` ### Relevant context - PR #360 added the Token Auth provider env bridge for `/home-platform/providers:OLLAMA_CLOUD_API_KEY`. - RS2000 release-root already had #360, but `sudo PYTHONPATH=control-plane python3 ... write_canary_env.py --backend token-auth` failed with `InfisicalAuthError: httpx required`. ### Runtime evidence - RS2000 pre-write attempt failed before secret read/output: `InfisicalAuthError: httpx required`. - No provider env file was written. - Error report contained no secret values. ### Known constraints - This does not widen any Infisical ACL. - A real 403 after this PR remains an ACL problem for the Token Auth identity. - This does not deploy Honcho or restart Honcho services. ### Explicit out-of-scope - Installing Python dependencies on RS2000. - Changing Infisical token scopes. - Retrying Honcho deploy before this lands on release-root. ### Requested decision Merge so RS2000 release-root can render the Honcho provider env file using host Python without ad-hoc package installation. ### Merge blockers - Secret values appearing in errors/logs. - Fallback changing the existing `httpx` behavior when `httpx` is available. - Weakening token file permission checks. ## Spec sources read - `control-plane/platformctl/secrets/infisical.py` — Infisical secret read implementation. - `control-plane/platformctl/tests/test_infisical_cache.py` — existing token/auth tests. - `runbooks/honcho-ollama-gemma-switch.md` — runtime command that exposed the host Python dependency gap. ## Test Plan - `python3 -m py_compile control-plane/platformctl/secrets/infisical.py control-plane/platformctl/ci/write_canary_env.py` - `control-plane/.venv/bin/python -m pytest -q control-plane/platformctl/tests/test_infisical_cache.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `ruff check control-plane/platformctl/secrets/infisical.py control-plane/platformctl/tests/test_infisical_cache.py control-plane/platformctl/ci/write_canary_env.py` - `git diff --check` Commit: `43254a2`

codex added 1 commit

2026-05-18 08:00:39 +02:00

fix(infisical): allow host python secret reads without httpx

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s

Details

python-ci / Python 3.11 (pull_request) Successful in 39s