| name | secrets-vault |
| description | Encrypted-in-repo secret vault (SOPS + age) so a lost laptop never means lost keys: every project's secrets are committed to git as age CIPHERTEXT and a fresh `git clone` + ONE master key restores everything (`sops -d`). A repo leak yields only ciphertext. Implements the R-SECRETS-VAULT doctrine. Use when the user says "vault", "encrypt my secrets", "secret backup", "recover my keys", "commit my API keys", "sops", "age", "never lose a key", or in French "coffre-fort", "chiffrer mes secrets", "sauvegarder mes cles", "recuperer mes cles". NOT for live secret INJECTION into a running app (that stays a plaintext .env in ~/.omega); NOT for public repos (they NEVER carry ciphertext).
|
| argument-hint | init <repo> | add <src> <vault> <restore> | verify <vault> | restore [vault] |
| allowed-tools | ["Bash","Read","Write"] |
| domain | safety |
| read_only | false |
| triggers | ["vault","encrypt my secrets","secret backup","recover my keys","commit my api keys","sops","age","never lose a key","coffre-fort","chiffrer mes secrets","recuperer mes cles"] |
secrets-vault — encrypted-in-repo secret recovery (SOPS + age)
The operator's hard goal: lose the laptop, clone the GitHub repo, recover ALL API keys. This
skill delivers exactly that, safely, under R-SECRETS-VAULT — a narrowing of L0/R-ENV, never
an exception:
- Plaintext secret values + the master private key never touch a repo.
~/.omega stays the
plaintext source of truth; the vault is its encrypted recovery mirror.
- Only age ciphertext whose plaintext is machine-verified absent is committable, and only to
a PRIVATE repo. Public repos (OmegaOS, rmux) carry ciphertext never (harvest-now-decrypt-
later + readable key names are a permanent leak).
- One master age keypair at
~/.omega/secrets/age/master.txt (chmod 600). Its public recipient
is committed in .sops.yaml.
The two stores
| Store | What | Why |
|---|
agentik-os/omega-vault (PRIVATE) | SSOT superset: projects/<name>/vault/ + core/vault/ | ONE clone recovers EVERYTHING. Holds partner-owned / no-remote / orphan / central ~/.omega secrets. |
in-repo vault/ (operator-owned PRIVATE repos) | that project's own secrets, mirrored | a project clone is self-sufficient |
Tools (bin/, pure bash + sops + age — no node/bun/python on the recovery path)
vault-add.sh <src> <vault_dir> <restore_path> [name] — encrypt one file in, append MANIFEST,
prove the roundtrip (KV map for dotenv/json, byte for binary), gate on sops filestatus.vault-verify.sh <vault_dir> — adversarial re-check: every file encrypted + decrypts + no leak.vault-restore.sh [--dry-run] [vault_dir] — the recovery button. Reads MANIFEST.tsv,
sops -d every entry back to its real path, chmod 600.vault-lib.sh — shared helpers (format routing, filestatus gate, KV metric).
Format routing (council-verified at runtime — do NOT assume dotenv everywhere)
- plain
KEY=VALUE .env → sops dotenv
- multiline / PEM / JWT / inline-JSON value → binary (sops dotenv HARD-FAILS on multiline:
invalid dotenv input line)
.json → json (note: encrypts ALL string values, incl. non-secret names).toml / *.git-credentials / npmrc / .sh / .pem → binary (no native TOML/INI type)
Proof is runtime, not vibes (L1)
- A dotenv roundtrip is NOT byte-identical (comments become encrypted blobs, blank lines drop,
empty values stay plaintext) — verify the parsed KEY=VALUE map, never
cmp/sha the file.
gitleaks scans SOPS ciphertext CLEAN — it is NOT the encryption proof. The proof is
sops filestatus <f> == {"encrypted":true}.sops -d inherits umask (0644) — restore chmods 0600 (git-credentials, npmrc especially).
Custody (the one thing to guard)
The single master key honors the "one key" goal but is a total-compromise single point. Its backup
is MANDATORY and TEST-verified: operator password manager + an OFFLINE copy (paper/steel/
USB in a safe), stored beside the GitHub 2FA recovery codes and a bootstrap clone token that
lives OUTSIDE omega-vault (else recovery cannot bootstrap). NEVER put the master key in GitHub
Actions (that recouples key + ciphertext) — mint a scoped CI recipient if CI ever needs decrypt,
never the master. See RECOVERY.md.
Incident policy (a plaintext secret already pushed)
Rotation is the default remediation: rotate the live credential → untrack + placeholder-scrub →
history-rewrite only on operator sign-off (force-push is R-COUNCIL). Ciphertext-in-history and
pushed-plaintext-in-history are both readable forever; master-key rotation does not remediate a
leaked value — only rotating the value does. Keep the vault in sync on every rotation (a stale vault
silently restores a dead key).
v2 hardening (recorded, council dissent)
Passphrase-wrap (age -p) or yubikey-back the at-rest identity; split a recovery key (PM/offline
only) from per-project operational recipients for real cryptographic R-PROJ blast-radius containment.
vault-lib.sh already supports multiple recipients via VAULT_RECIPIENT.
