secrets-vault

# secrets-vault — encrypted-in-repo secret recovery (SOPS + age) The operator's hard goal: **lose the laptop, clone the GitHub repo, recover ALL API keys.** This skill delivers exactly that, safely, under **R-SECRETS-VAULT** — a *narrowing* of L0/R-ENV, never an exception: - Plaintext secret values + the master private key **never** touch a repo. `~/.omega` stays the plaintext source of truth; the vault is its **encrypted recovery mirror**. - Only **age ciphertext** whose plaintext is machine-verified absent is committable, and **only to a PRIVATE repo**. Public repos (OmegaOS, rmux) carry ciphertext **never** (harvest-now-decrypt- later + readable key names are a permanent leak). - One master age keypair at `~/.omega/secrets/age/master.txt` (chmod 600). Its **public** recipient is committed in `.sops.yaml`. ## The two stores | Store | What | Why | |---|---|---| | `agentik-os/omega-vault` (PRIVATE) | SSOT superset: `projects/<name>/vault/` + `core/vault/` | ONE clone recovers EVERYTHING. Holds partner-owned / no-remote / orphan / central `~/.omega` secrets. | | in-repo `vault/` (operator-owned PRIVATE repos) | that project's own secrets, mirrored | a project clone is self-sufficient | ## Tools (`bin/`, pure bash + sops + age — no node/bun/python on the recovery path) - `vault-add.sh <src> <vault_dir> <restore_path> [name]` — encrypt one file in, append MANIFEST, prove the roundtrip (KV map for dotenv/json, byte for binary), gate on `sops filestatus`. - `vault-verify.sh <vault_dir>` — adversarial re-check: every file encrypted + decrypts + no leak. - `vault-restore.sh [--dry-run] [vault_dir]` — **the recovery button.** Reads `MANIFEST.tsv`, `sops -d` every entry back to its real path, chmod 600. - `vault-lib.sh` — shared helpers (format routing, filestatus gate, KV metric). ## Format routing (council-verified at runtime — do NOT assume dotenv everywhere) - plain `KEY=VALUE` `.env` → **sops dotenv** - multiline / PEM / JWT / inline-JSON value → **binary** (sops dotenv HARD-FAILS on multiline: `invalid dotenv input line`) - `.json` → **json** (note: encrypts ALL string values, incl. non-secret names) - `.toml` / `*.git-credentials` / `npmrc` / `.sh` / `.pem` → **binary** (no native TOML/INI type) ## Proof is runtime, not vibes (L1) - A dotenv roundtrip is **NOT byte-identical** (comments become encrypted blobs, blank lines drop, empty values stay plaintext) — verify the **parsed KEY=VALUE map**, never `cmp`/sha the file. - `gitleaks` scans SOPS ciphertext **CLEAN** — it is NOT the encryption proof. The proof is `sops filestatus <f>` == `{"encrypted":true}`. - `sops -d` inherits umask (0644) — restore **chmods 0600** (git-credentials, npmrc especially). ## Custody (the one thing to guard) The single master key honors the "one key" goal but is a total-compromise single point. Its backup is **MANDATORY and TEST-verified**: operator **password manager** + an **OFFLINE** copy (paper/steel/ USB in a safe), stored beside the **GitHub 2FA recovery codes** and a **bootstrap clone token that lives OUTSIDE omega-vault** (else recovery cannot bootstrap). **NEVER** put the master key in GitHub Actions (that recouples key + ciphertext) — mint a scoped CI recipient if CI ever needs decrypt, never the master. See `RECOVERY.md`. ## Incident policy (a plaintext secret already pushed) Rotation is the **default** remediation: rotate the live credential → untrack + placeholder-scrub → history-rewrite **only on operator sign-off** (force-push is R-COUNCIL). Ciphertext-in-history and pushed-plaintext-in-history are both readable forever; master-key rotation does **not** remediate a leaked value — only rotating the value does. Keep the vault in sync on every rotation (a stale vault silently restores a dead key). ## v2 hardening (recorded, council dissent) Passphrase-wrap (`age -p`) or yubikey-back the at-rest identity; split a recovery key (PM/offline only) from per-project operational recipients for real cryptographic R-PROJ blast-radius containment. `vault-lib.sh` already supports multiple recipients via `VAULT_RECIPIENT`.