docs(secrets): choose Infisical primary pipeline #438

Merged

pdurlej merged 1 commit from codex/w4/continue into main

2026-05-24 19:39:13 +02:00

codex commented

2026-05-24 19:27:18 +02:00

Collaborator

Canary status: missing — ADR/runbook-only security-sensitive decision PR; rely on required Forgejo checks before merge

Canary Context Pack

Product story

W4 needs to stop re-litigating BWS vs Infisical on every secrets task. The operator needs one boring default so future agents can fix leaks and migrate runtime secrets incrementally without inventing a new backend plan each time.

What changed

Added ADR-0024: Infisical is the primary platform secrets backend.
Added runbooks/secrets-pipeline.md with source hierarchy, evidence rules, cutover pattern, and break-glass rules.
Updated Vault-to-Infisical prebuild docs to depend on ADR-0024 rather than an undecided #237 backend choice.
Updated W4 status docs to mark W4c Slice 1 prepared.

Why it changed

#237 requires a decision PR before recon, leak fixes, or wire-up work. W4a already proved the deploy runner can run on Infisical Token Auth without direct PAT fallback, so the platform has enough evidence to make Infisical the default and treat BWS as legacy/recovery material unless a future ADR grants a narrow exception.

Files touched

decisions/0024-infisical-primary-secrets-pipeline.md
runbooks/secrets-pipeline.md
docs/specs/vault-to-infisical-migration-v0/00-constitution.md
docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md
state/cycle/W4-secrets-access-hardening-output.md
state/STATUS_NOW.md

Relevant context

#237 BWS/Infisical secrets injection gap
#265 deploy-runner Token Auth migration, now closed
#274 Token Auth rotation tracker
#124 Honcho Redis argv leak
Vault-to-Infisical prebuild
ADR-0018 agentic-first root cause discipline

Runtime evidence

None collected or changed in this PR. This is docs/decision only. It relies on W4a evidence already recorded in:

state/reports/w4a-deploy-runner-token-auth-2026-05-24.md
state/reports/w4a-direct-pat-removal-2026-05-24.md

Known constraints

No secret values are present. This PR does not claim BWS files are recovered; it only decides that BWS is not the default future backend.

Explicit out-of-scope

No runtime mutation.
No secret migration.
No Vault sunset.
No deletion or archival of BWS files yet.
No #124 Honcho Redis runtime leak fix yet.

Requested decision

Merge ADR-0024 so W4c can proceed to BWS recovery/archive and concrete leak fixes without another backend debate.

Merge blockers

Any secret value disclosure, incorrect backend statement, or disagreement that Infisical should be the default primary backend.

Spec sources read

state/cycle/W4-secrets-access-hardening-output.md — W4 sequence and #237 handling
state/STATUS_NOW.md — active operator-facing state
docs/forgejo-agent-operations.md — existing Infisical and identity rules
docs/specs/vault-to-infisical-migration-v0/00-constitution.md — Vault migration dependency on #237 Slice 1
docs/specs/vault-to-infisical-migration-v0/01-specify.md — Vault migration assumptions and target state
docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md — sibling dependency notes
Forgejo issue #237 — acceptance criteria and sequence

Refs #237

Canary status: missing — ADR/runbook-only security-sensitive decision PR; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W4 needs to stop re-litigating BWS vs Infisical on every secrets task. The operator needs one boring default so future agents can fix leaks and migrate runtime secrets incrementally without inventing a new backend plan each time. ### What changed - Added ADR-0024: Infisical is the primary platform secrets backend. - Added `runbooks/secrets-pipeline.md` with source hierarchy, evidence rules, cutover pattern, and break-glass rules. - Updated Vault-to-Infisical prebuild docs to depend on ADR-0024 rather than an undecided #237 backend choice. - Updated W4 status docs to mark W4c Slice 1 prepared. ### Why it changed #237 requires a decision PR before recon, leak fixes, or wire-up work. W4a already proved the deploy runner can run on Infisical Token Auth without direct PAT fallback, so the platform has enough evidence to make Infisical the default and treat BWS as legacy/recovery material unless a future ADR grants a narrow exception. ### Files touched - `decisions/0024-infisical-primary-secrets-pipeline.md` - `runbooks/secrets-pipeline.md` - `docs/specs/vault-to-infisical-migration-v0/00-constitution.md` - `docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md` - `state/cycle/W4-secrets-access-hardening-output.md` - `state/STATUS_NOW.md` ### Relevant context - #237 BWS/Infisical secrets injection gap - #265 deploy-runner Token Auth migration, now closed - #274 Token Auth rotation tracker - #124 Honcho Redis argv leak - Vault-to-Infisical prebuild - ADR-0018 agentic-first root cause discipline ### Runtime evidence None collected or changed in this PR. This is docs/decision only. It relies on W4a evidence already recorded in: - `state/reports/w4a-deploy-runner-token-auth-2026-05-24.md` - `state/reports/w4a-direct-pat-removal-2026-05-24.md` ### Known constraints No secret values are present. This PR does not claim BWS files are recovered; it only decides that BWS is not the default future backend. ### Explicit out-of-scope - No runtime mutation. - No secret migration. - No Vault sunset. - No deletion or archival of BWS files yet. - No #124 Honcho Redis runtime leak fix yet. ### Requested decision Merge ADR-0024 so W4c can proceed to BWS recovery/archive and concrete leak fixes without another backend debate. ### Merge blockers Any secret value disclosure, incorrect backend statement, or disagreement that Infisical should be the default primary backend. ## Spec sources read - `state/cycle/W4-secrets-access-hardening-output.md` — W4 sequence and #237 handling - `state/STATUS_NOW.md` — active operator-facing state - `docs/forgejo-agent-operations.md` — existing Infisical and identity rules - `docs/specs/vault-to-infisical-migration-v0/00-constitution.md` — Vault migration dependency on #237 Slice 1 - `docs/specs/vault-to-infisical-migration-v0/01-specify.md` — Vault migration assumptions and target state - `docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md` — sibling dependency notes - Forgejo issue #237 — acceptance criteria and sequence Refs #237

codex added 1 commit

2026-05-24 19:27:18 +02:00

docs(secrets): choose Infisical primary pipeline

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 22s