secrets-pii

name	secrets-pii
description	Secrets, age keys, OAuth/break-glass, and student-PII hard boundaries for the kit.

Skill: secrets-pii

Use when handling secrets, age keys, OAuth/break-glass material, or any data that could contain student PII.

Hard boundaries (REQ-031)

1. Never commit secrets, age keys, OAuth/break-glass secrets, or valued .env files.
2. Never treat .env as secret source of truth — use fnox.
3. Prefer fnox exec -- <command> and non-interactive secret paths.
4. Never print secrets or student PII in chat, logs, commits, or PR text.
5. Synthetic fixtures only (REQ-028).
6. Do not log full PII bodies, cookies, or Authorization headers (REQ-009).
7. CLI uses env secrets for routine runs — not browser SSO.
8. SPA must not store Google tokens in web storage.
9. Empty/missing allowlist MUST remain fail-closed (REQ-018).
10. Deploy docs list secret names only (docs/ops/env-names.md).
11. No dual pipeline bodies in CLI/API adapters (REQ-003).

Local layout

Path	Role
fnox.toml	Committed structure / ciphertext; no private keys
Age private key	Out of git (FNOX_AGE_KEY or ignored path)
.env / .env.*	Gitignored; not SoT
docs/ops/env-names.md	Names only

Bootstrap age + fnox

See root fnox.toml comments and docs/ops/bootstrap.md.

When in doubt

Stop. Do not invent live credentials. Prefer synthetic fixtures and fail-closed tests.