| name | secrets-pii |
| description | Secrets, age keys, OAuth/break-glass, and student-PII hard boundaries for the kit. |
Skill: secrets-pii
Use when handling secrets, age keys, OAuth/break-glass material, or any data that
could contain student PII.
Hard boundaries (REQ-031)
- Never commit secrets, age keys, OAuth/break-glass secrets, or valued
.env files.
- Never treat
.env as secret source of truth — use fnox.
- Prefer
fnox exec -- <command> and non-interactive secret paths.
- Never print secrets or student PII in chat, logs, commits, or PR text.
- Synthetic fixtures only (REQ-028).
- Do not log full PII bodies, cookies, or Authorization headers (REQ-009).
- CLI uses env secrets for routine runs — not browser SSO.
- SPA must not store Google tokens in web storage.
- Empty/missing allowlist MUST remain fail-closed (REQ-018).
- Deploy docs list secret names only (
docs/ops/env-names.md).
- No dual pipeline bodies in CLI/API adapters (REQ-003).
Local layout
| Path | Role |
|---|
fnox.toml | Committed structure / ciphertext; no private keys |
| Age private key | Out of git (FNOX_AGE_KEY or ignored path) |
.env / .env.* | Gitignored; not SoT |
docs/ops/env-names.md | Names only |
Bootstrap age + fnox
See root fnox.toml comments and docs/ops/bootstrap.md.
When in doubt
Stop. Do not invent live credentials. Prefer synthetic fixtures and fail-closed tests.
