Menu
OpenBao/Vault credential seeding and management scripts
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Generate throughput and quality reports from coordinator audit data and episodic memory
Execute roadmap items iteratively with policy-aware vendor routing and learning feedback
Orchestrate the full plan-review-implement-validate-PR lifecycle with multi-vendor review convergence
Merge approved PR, migrate open tasks, archive OpenSpec proposal, and cleanup branches
Ingest raw session transcripts from coding-agent harnesses via vendor-specific adapters, normalize to a common event schema, triage for struggle signals, and write structured findings to episodic memory
HTTP fallback bridge for coordinator when MCP transport is unavailable
| name | bao-vault |
| description | OpenBao/Vault credential seeding and management scripts |
| category | Infrastructure |
| tags | ["bao","vault","credentials","infrastructure"] |
| user_invocable | false |
Non-user-invocable infrastructure skill for OpenBao/Vault credential seeding and management.
Seeds OpenBao with agent API keys and secrets from agents.yaml configuration. Reads any string-valued key in .secrets.yaml and writes it under the configured KV mount, so adding new credential names (e.g. LANGFUSE_PUBLIC_KEY) requires no code change — just add the key to .secrets.yaml and re-run.
Usage:
python3 "<skill-base-dir>/scripts/bao_seed.py" [options]
Environment variables:
BAO_ADDR — OpenBao server addressBAO_TOKEN — Root or privileged token for seedingExit codes: 0 = seeded successfully, 1 = error
Resolves LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_HOST from OpenBao (preferring values already in the environment), computes LANGFUSE_BASIC_AUTH = base64(public:secret), and emits four export lines on stdout. Designed to be sourced via eval:
eval "$(skills/bao-vault/scripts/langfuse_env.sh)"
Falls back silently when BAO_ADDR is unset or the keys are already populated, so it is safe to put in shell init or scripts.
Authentication: prefers BAO_TOKEN if set, otherwise uses AppRole login via BAO_ROLE_ID + BAO_SECRET_ID (matches bao_seed.py).
Consumed by:
skills/langfuse/scripts/install-mcp.sh — to compute the literal Basic-auth token written into Codex / Gemini user-global config files.skills/langfuse/scripts/run_stop_hook.sh — to populate the env for the Claude Code Stop-hook tracer.