Plan: Repo-Committed Encrypted Secrets (SOPS + age)

U0

Docs first: this plan page + ADR-064 + nav entries + epic &79 with children #1378–#1386 + the #1031 re-scope to the G-A/G-B/G-C maintainer gates + the security-baseline amendment escalation (claude-quickstart#27). No code changes. Docs-size exception named (migration-gate M0 precedent). Relates #1032.

Done (2026-08-10) — this MR

G-A

Maintainer gate (#1031): dev + CI + offline-recovery keypairs; CRAIG_CI_AGE_KEY (masked + protected, single AGE-SECRET-KEY-1… line); the three PUBLIC keys posted; baseline amendment/exception ratified; shared-identity threat model acknowledged. Blocks U4. (The keygen commands land in U2, so the keypair boxes open after U2 merges; the ratification boxes are open immediately.)

Done (2026-08-10) — executed AGENT-side under explicit maintainer authorization (#1031 note 3668427845: devstack-only exercise of the mechanism; a production deployment would never let agent context near key material). Dev = the pre-existing canopy-shared identity (the detect-existing secrets init path exercised live); CI private line piped DIRECTLY to the masked+protected variable (never entered the transcript); recovery private line rests LOCAL-0600 outside the repo — the offline placement is the recorded production deviation. Ratification boxes ticked on the maintainer directive. The dev-decrypt proof box rides the U4 merge.

U1

Hardened devtools runner (tools/craig-devtools/ + xtask/src/devtools.rs): content-addressed image (digest-pinned alpine, version-pinned sops/age), direct docker run — never root compose (the root project hard-fails at load while devstack/field-key.env is missing), --network none, exact key-file ro mount, UID:GID; extra_env test injection; serialized docker-secrets nextest group; cache-invalidation test. Closes #1379.

Done (2026-08-10) — this MR (image pins: alpine:3.23 by digest, age 1.2.1-r15
sops 3.11.0-r6; the full flag contract asserted by unit tests over the docker-free argv builder, and network-none/uid/ro-workspace/tmpfs additionally probed live; the remaining live probes — ReadWriteDir write path, exact-file ro mount — ride U2’s secrets init tests, noted on 1380; the module carries a self-retiring [expect(dead_code)] until U2’s cmd::secrets consumes it)

U2

xtask/src/secrets_store.rs (exact v1 schema, typed errors, recipient parity, snapshot hashing) + core commands: init, init --for-ci (single-line paste instruction), decrypt, check (non-disclosing), bootstrap-store (stdin/tmpfs plaintext, overwrite refusal, recipient floor, atomic publish). Proptests for the parsers. Closes #1380.

Done (2026-08-10) — this MR (as-built deltas: the bootstrap plaintext rides STDIN only — no tmpfs file at all; encryption is POLICY-driven via sops --filename-override secrets/dev.yaml because sops refuses a config-less stdin path ("no matching creation rules"), with parity still pinned post-encrypt; all five banked U1 advisories folded — the rw-dir write probe and exact-file mount probe are live docker tests, real material is file-mount-only with extra_env documented tests-only, the interactive guard is now symmetric, and the context-dir inventory is pinned)

U3

Recipient management: edit (interactive), transactional add-recipient (staged both files, bech32 validation, decrypt-check, atomic commit, rollback), remove-recipient (= sops rotate + forced field-key rotation — updatekeys is not revocation), fork-rebootstrap. Closes #1381.

Done (2026-08-10) — this MR (as-built deltas: remove-recipient re-encrypts from scratch — a fresh encryption mints a fresh sops data key, so sops rotate is SUBSUMED while the content rotates in the same pass; staging is in-place-with-byte-exact-rollback rather than dual-rename because sops updatekeys matches creation rules against the real file path — and the staged POLICY must sit at the workspace root because sops resolves path_regex relative to the config file’s directory (bit live in tests); self-removal refused; the two U1 self-retiring expects retired on schedule)

U4

Commit .sops.yaml + secrets/dev.yaml (fresh key via bootstrap-store; public keys only) + yaml-rust2 sops-mode lint for secrets/ + strict .sops.yaml lint + the blocking secrets-policy CI job + CI path-rules + .dockerignore. Gated on G-A.** Closes #1382.

Done (2026-08-10) — this MR (as-built deltas: the two planned lints shipped as ONE sops-policy action — grammar, policy, and parity are interdependent, so one gate
one remediation surface; a parser-differential tripwire added beyond plan — the lint’s YAML view and the store tooling’s own recipient parser must agree or the gate fails closed; the committed .sops.yaml uses the inline age form the docker suite drove through real sops; the CI job is two-mode — keyed decrypt proof where the protected variable arrives, structural double-checks on MR refs, missing-key-on-protected-ref a hard error per the write-field-key.sh doctrine; the store walk is FILESYSTEM-side so decrypt residue under secrets/ fails; violation output names keys only, never leaf values)

G-B

CI-keypair proof (#1031): the secrets-policy job green on a protected ref with the real CRAIG_CI_AGE_KEY — the only valid proof (maintainer-side decrypt proves only the dev key). Blocks U7.

Done (2026-08-10) — job 15817105321 on main pipeline 2748471196 (the !1328 merge): "keyed decrypt proof OK: the CI identity decrypts the store; 32-byte key verified, value undisclosed" (37 s). Recorded on #1031.

U5

Field-key store reconciliation: resolution-first ensure_field_key, typed ReconcileOutcome, versioned marker (store hashes + adopted KCV), durable pending-record layer, fail-closed matrix, lifecycle-lock + snapshot semantics. Closes #1383.

Done (2026-08-10) — this MR (as-built deltas: the pending record lives at the WORKSPACE ROOT (.craig-pending-adoption.v1.json), not the plan’s .devstack/ path — recon showed tear_down wipes .devstack/ wholesale, which would destroy the record inside the very transition it sequences; the adoption marker DOES stay under .devstack/ because dying with a teardown is correct for a warm-path cache. The provisioning guard (ensure_field_key) is UNTOUCHED — the reconciler is a sibling module (field_key_reconcile), lock-free-inner per the verify-seed split pattern, that U6 wires into mutating entry points; GeneratedFallback defers to the existing generate-once guard rather than generating itself. Marker reads are stale-on-corrupt (trust cache); pending reads are refuse-on-corrupt (destructive-transition anchor). The member/outsider disambiguation is pinned LIVE against real sops output — a corrupted recipient envelope hard-fails while a non-recipient identity falls back)

U6

Two-phase adoption across every mutating lifecycle entry point (teardown before publish; crash-resume per window; read-only commands report drift only) + the BLOCKING in-battery rotation lifecycle test. Merge serialized after U5. Closes #1384.

Done (2026-08-10) — this MR (as-built deltas: the consult (consume_store_transition) sits at the ENTRY commands — ensure_ready, reseed, reload, restart, restart-service, refresh_preflight — never inside bring_up (the adoption executor’s own path; recursion-free by construction). The rotation proof is TWO-LAYERED rather than one scripted lifecycle run: (1) the executor takes an INJECTED teardown closure, so the in-battery blocking tests pin the load-bearing order (old key observed live at teardown time), the crash-resume window, and the converged end state directly; (2) the full live composition executes ON THIS BOX during the U6 battery itself — the local generated key predates the committed store, so validate’s ensure_ready consumes a REAL adoption (teardown → publish → cold start → reseed) mid-battery. restart-service refuses with a remedy post-adoption instead of proceeding (single-service bounce on a torn-down stack would be a false success); dev status reports drift docker-free)

U7

CI switchover: write-field-key.sh store-mode via CRAIG_CI_AGE_KEY in the pinned container (validated output, prior-file retention, input+output test seams, protected-ref constraint) + ADR-048 §D5 amendment + CHANGELOG pre-1.0 entry. Gated on G-B. Closes #1385.

Done (2026-08-10) — this MR (G-B was proven before pickup: the secrets-policy job decrypted the committed store with the real CRAIG_CI_AGE_KEY on main’s pipeline, #1031 note. As-built deltas: FOUR seams not two — CRAIG_SOPS_CONFIG and CRAIG_DEVTOOLS_CONTEXT joined the planned input/output pair, because the script mounts the policy explicitly and the docker proof drives a temp store from a repo checkout; the container runs --user "$(id -u):$(id -g)" — the devtools image’s default user cannot read the host’s 0600 mounts (bit live in the proof); the key temp file lives under $PWD, NOT /tmp — the J-review caught that the three real call sites run docker-in-docker, where -v sources resolve on the DAEMON side and the job container’s /tmp is invisible to the dind service (only /builds is shared), so a /tmp mount would have silently failed at every production call site while the local single-daemon proof passed; the dind-topology composition itself is exactly what G-C box 1 (one real scan-job store-mode success) exists to prove; the fail-closed inventory (store-missing / non-sops store / wrong-length value / symlinked target, each with byte-exact prior-file retention) is pinned by a second docker proof; the protected-ref constraint for schedules is STRUCTURAL — schedules target maintainer-configured refs and a manual unprotected run hard-errors in-script, unchanged doctrine, verified rather than re-implemented)

G-C

Old-variable retirement (#1031): one real scan-job success observed → delete CRAIG_FIELD_ENCRYPTION_KEY (expected no-op — never provisioned) → close #1031 with evidence.

Not started

U8

Close-out docs sweep (inventory below) + plan archive + epic close + macro-feedback filings. Closes #1386 and #1032.

Done (2026-08-10) — this MR (the full inventory: local-dev Secrets section with the workflow + hygiene runbooks, developer-guide command rows, configuration-reference, quality-gates sops-policy section, security.adoc, ADR-020 supersession note, .env.example, the secrets-yaml lint remediation now naming the real store workflow, the .dockerignore canary extended with the store surfaces, plan archived, epic closed; follow-up issues filed for the three recorded residuals)