secrets-vault

name	secrets-vault
description	Encrypted-in-repo secret vault (SOPS + age) so a lost laptop never means lost keys: every project's secrets are committed to git as age CIPHERTEXT and a fresh `git clone` + ONE master key restores everything (`sops -d`). A repo leak yields only ciphertext. Implements the R-SECRETS-VAULT doctrine. Use when the user says "vault", "encrypt my secrets", "secret backup", "recover my keys", "commit my API keys", "sops", "age", "never lose a key", or in French "coffre-fort", "chiffrer mes secrets", "sauvegarder mes cles", "recuperer mes cles". NOT for live secret INJECTION into a running app (that stays a plaintext .env in ~/.omega); NOT for public repos (they NEVER carry ciphertext).
argument-hint	init <repo> | add <src> <vault> <restore> | verify <vault> | restore [vault]
allowed-tools	["Bash","Read","Write"]
domain	safety
read_only	false
triggers	["vault","encrypt my secrets","secret backup","recover my keys","commit my api keys","sops","age","never lose a key","coffre-fort","chiffrer mes secrets","recuperer mes cles"]

secrets-vault — encrypted-in-repo secret recovery (SOPS + age)

The operator's hard goal: lose the laptop, clone the GitHub repo, recover ALL API keys. This skill delivers exactly that, safely, under R-SECRETS-VAULT — a narrowing of L0/R-ENV, never an exception:

• Plaintext secret values + the master private key never touch a repo. ~/.omega stays the plaintext source of truth; the vault is its encrypted recovery mirror.
• Only age ciphertext whose plaintext is machine-verified absent is committable, and only to a PRIVATE repo. Public repos (OmegaOS, rmux) carry ciphertext never (harvest-now-decrypt- later + readable key names are a permanent leak).
• One master age keypair at ~/.omega/secrets/age/master.txt (chmod 600). Its public recipient is committed in .sops.yaml.

The two stores

Store	What	Why
agentik-os/omega-vault (PRIVATE)	SSOT superset: projects/<name>/vault/ + core/vault/	ONE clone recovers EVERYTHING. Holds partner-owned / no-remote / orphan / central ~/.omega secrets.
in-repo vault/ (operator-owned PRIVATE repos)	that project's own secrets, mirrored	a project clone is self-sufficient

Tools (bin/, pure bash + sops + age — no node/bun/python on the recovery path)

• vault-add.sh <src> <vault_dir> <restore_path> [name] — encrypt one file in, append MANIFEST, prove the roundtrip (KV map for dotenv/json, byte for binary), gate on sops filestatus.
• vault-verify.sh <vault_dir> — adversarial re-check: every file encrypted + decrypts + no leak.
• vault-restore.sh [--dry-run] [vault_dir] — the recovery button. Reads MANIFEST.tsv, sops -d every entry back to its real path, chmod 600.
• vault-lib.sh — shared helpers (format routing, filestatus gate, KV metric).

Format routing (council-verified at runtime — do NOT assume dotenv everywhere)

• plain KEY=VALUE .env → sops dotenv
• multiline / PEM / JWT / inline-JSON value → binary (sops dotenv HARD-FAILS on multiline: invalid dotenv input line)
• .json → json (note: encrypts ALL string values, incl. non-secret names)
• .toml / *.git-credentials / npmrc / .sh / .pem → binary (no native TOML/INI type)

Proof is runtime, not vibes (L1)

• A dotenv roundtrip is NOT byte-identical (comments become encrypted blobs, blank lines drop, empty values stay plaintext) — verify the parsed KEY=VALUE map, never cmp/sha the file.
• gitleaks scans SOPS ciphertext CLEAN — it is NOT the encryption proof. The proof is sops filestatus <f> == {"encrypted":true}.
• sops -d inherits umask (0644) — restore chmods 0600 (git-credentials, npmrc especially).

Custody (the one thing to guard)

The single master key honors the "one key" goal but is a total-compromise single point. Its backup is MANDATORY and TEST-verified: operator password manager + an OFFLINE copy (paper/steel/ USB in a safe), stored beside the GitHub 2FA recovery codes and a bootstrap clone token that lives OUTSIDE omega-vault (else recovery cannot bootstrap). NEVER put the master key in GitHub Actions (that recouples key + ciphertext) — mint a scoped CI recipient if CI ever needs decrypt, never the master. See RECOVERY.md.

Incident policy (a plaintext secret already pushed)

Rotation is the default remediation: rotate the live credential → untrack + placeholder-scrub → history-rewrite only on operator sign-off (force-push is R-COUNCIL). Ciphertext-in-history and pushed-plaintext-in-history are both readable forever; master-key rotation does not remediate a leaked value — only rotating the value does. Keep the vault in sync on every rotation (a stale vault silently restores a dead key).

v2 hardening (recorded, council dissent)

Passphrase-wrap (age -p) or yubikey-back the at-rest identity; split a recovery key (PM/offline only) from per-project operational recipients for real cryptographic R-PROJ blast-radius containment. vault-lib.sh already supports multiple recipients via VAULT_RECIPIENT.