Production secrets — set a Forgejo Actions secret by its natural name -> the app repo's sync-env workflow reads them via ${{ toJSON(secrets) }} -> mcp secrets-cli seals them into <app>-user-env (sops) -> app consumes via chart extraEnvFrom -> pod auto-rolls. Validated end-to-end (weather app).
Dev scope (#15) — a readable Forgejo Variable PLAT_DEV lists secret NAMES that are "development"; those seal into <owner>--<app>--dev and the dispatcher injects them into the Claude builder's run env (throwaway tokens the --dangerously-skip-permissions agent may use freely while coding). Loud seam: a PLAT_DEV name with no secret is a HARD sync failure + a reconciliation table.
External egress — apps had zero internet egress; default now allows 443/80 excl RFC1918 so external-API apps work (#13 tracks the Cilium FQDN tightening).
#16 credential boundary — the builder agent is now NON-admin: clones via a per-repo SSH deploy key, uses a scoped mint_agent_token MCP bearer (mcp authorizes per-(owner,app)), and .forgejo/workflows/** is branch-protected so it can't add a toJSON(secrets)-exfil workflow. RED-TEAM VALIDATED on gc.local (all 5 guarantees PASS, app still builds). #16 is CLOSED.

Version map (all merged to main): mcp 0.23.15 (secrets-cli + dev-scope + #16 authz) · agents 0.7.3 (dev inject + spawnEnv allowlist + resilience + #16 deploy-key/scoped-MCP) · _app-template (sync-env + PLAT_DEV + auto-roll) · mitosis (DNS coredns fix #12).

DEPLOY STATE — READ THIS:

open-platform.sh (prod): mcp 0.23.9 + agents 0.7.2. Does NOT run the secrets stack. Deploying it = a 6-version mcp big-bang (whole secrets stack) onto live apps — the owner DEFERRED this deliberately. Access: ssh vxrail -> cluster k3d-platgold2 (READ-ONLY for diagnosis; the host's default kubectl targets it). NEVER touch espo/nix01.
gc.local was the validation platform (ran the full 0.23.15/0.7.3 stack, red-teamed) but was TORN DOWN this session for the cold-start test. No local platform currently runs the stack — a future agent must germinate one (or deploy to prod) to test live.

Open PRs: plat/mitosis#20 (refreshed bundled seed carrying the stack — toward #14), #18 (#16 germinate provisioning — HAS A CONFLICT, needs rebase onto main). Non-secrets efforts still in PRs: Grafana (#8, mcp#1, gitops#2), agent-work (agents#2), docs (#9, #10).

Next steps: (1) validate a fresh germination from the refreshed seed once #19 is fixed, then merge #20. (2) deploy the stack to open-platform.sh when the owner wants (order: mcp 0.23.15 FIRST, then agents 0.7.3 together; add config.forgejoSsh: forgejo-ssh.forgejo.svc.cluster.local:22 to the agents HelmRelease; openssh-client already in the agents image; post-deploy assert a fresh app rejects a workflow push + agent env has no PAT). (3) harden #19. (4) rebase #18. (5) preview-scope secrets (Phase 3 of #15) + streaming (#17) remain.

## STATUS: self-serve secrets is DELIVERED (as of this session). Handoff context for the next agent. **What shipped (merged to `main` on origin):** - **Production secrets** — set a Forgejo Actions secret by its natural name -> the app repo's `sync-env` workflow reads them via `${{ toJSON(secrets) }}` -> mcp `secrets-cli` seals them into `<app>-user-env` (sops) -> app consumes via chart `extraEnvFrom` -> pod auto-rolls. Validated end-to-end (weather app). - **Dev scope** (#15) — a readable Forgejo Variable `PLAT_DEV` lists secret NAMES that are "development"; those seal into `<owner>--<app>--dev` and the dispatcher injects them into the Claude builder's run env (throwaway tokens the `--dangerously-skip-permissions` agent may use freely while coding). Loud seam: a PLAT_DEV name with no secret is a HARD sync failure + a reconciliation table. - **External egress** — apps had zero internet egress; default now allows 443/80 excl RFC1918 so external-API apps work (#13 tracks the Cilium FQDN tightening). - **#16 credential boundary** — the builder agent is now NON-admin: clones via a per-repo SSH deploy key, uses a scoped `mint_agent_token` MCP bearer (mcp authorizes per-`(owner,app)`), and `.forgejo/workflows/**` is branch-protected so it can't add a `toJSON(secrets)`-exfil workflow. RED-TEAM VALIDATED on gc.local (all 5 guarantees PASS, app still builds). #16 is CLOSED. **Version map (all merged to main):** mcp **0.23.15** (secrets-cli + dev-scope + #16 authz) · agents **0.7.3** (dev inject + spawnEnv allowlist + resilience + #16 deploy-key/scoped-MCP) · _app-template (sync-env + PLAT_DEV + auto-roll) · mitosis (DNS coredns fix #12). **DEPLOY STATE — READ THIS:** - **open-platform.sh (prod): mcp 0.23.9 + agents 0.7.2. Does NOT run the secrets stack.** Deploying it = a 6-version mcp big-bang (whole secrets stack) onto live apps — the owner DEFERRED this deliberately. Access: `ssh vxrail` -> cluster `k3d-platgold2` (READ-ONLY for diagnosis; the host's default kubectl targets it). NEVER touch espo/nix01. - **gc.local was the validation platform (ran the full 0.23.15/0.7.3 stack, red-teamed) but was TORN DOWN this session for the cold-start test. No local platform currently runs the stack** — a future agent must germinate one (or deploy to prod) to test live. **Open PRs:** `plat/mitosis#20` (refreshed bundled seed carrying the stack — toward #14), `#18` (#16 germinate provisioning — HAS A CONFLICT, needs rebase onto main). Non-secrets efforts still in PRs: Grafana (#8, mcp#1, gitops#2), agent-work (agents#2), docs (#9, #10). **Next steps:** (1) validate a fresh germination from the refreshed seed once #19 is fixed, then merge #20. (2) deploy the stack to open-platform.sh when the owner wants (order: mcp 0.23.15 FIRST, then agents 0.7.3 together; add `config.forgejoSsh: forgejo-ssh.forgejo.svc.cluster.local:22` to the agents HelmRelease; openssh-client already in the agents image; post-deploy assert a fresh app rejects a workflow push + agent env has no PAT). (3) harden #19. (4) rebase #18. (5) preview-scope secrets (Phase 3 of #15) + streaming (#17) remain.

plat referenced this issue

2026-07-01 00:22:18 +00:00

Self-serve secret scoping: prod + throwaway-dev scopes via a control-plane Variable (not name-munging) #15

plat referenced this issue

2026-07-01 03:22:22 +00:00

/goal /ultracode-workflows [SEC-2] attribute human identity into the secrets-sync audit trail #44

plat commented

2026-07-02 02:35:23 +00:00

Owner

Audit (team-board): DELIVERED and validated end-to-end — closing.

Shipped (all merged):

plat/mcp#2 (c5009c4b) — Forgejo Actions secrets → secrets-cli seals sops <app>-user-env → chart extraEnvFrom → pod auto-rolls
plat/_app-template#1 (10010fda) — sync-env workflow + auto-roll
plat/agents#3 (bbe30613) — dev-scoped secrets injected into the builder (#15, closed alongside)
plat/mcp#3 (5d2db986) + plat/agents#5 (6ae7681a) + PR #18 (460a9dd4) — the #16 credential boundary that makes the scoping enforceable (red-teamed)
hardening tail: SEC-1 PR #52 (age-key backup/rotation), SEC-2 (plat/mcp#4 + plat/_app-template#2, actor attribution), SEC-3 PR #54 (threat model)

Behavior verified live: end-to-end on real apps (weather; wb-rob2 clockface first-try); today's wb-gate daughter: rotate_age_key preserves a live app secret, old key decrypts nothing.

Backend note: the body suggested Vault; the shipped model is sops + Forgejo-native (Actions secrets as the write surface, fork-resealing preserves sovereignty) — rationale in the SEC-3 threat model. Open PR #9 carries the older Vault proposal for this issue (no closing keyword — safe); treat it as superseded.

Remaining tightenings live on their own issues: #13 (FQDN egress), #17 (observability), #42/#43 (policy Enforce flip).

Audit (team-board): DELIVERED and validated end-to-end — closing. **Shipped (all merged):** - plat/mcp#2 (c5009c4b) — Forgejo Actions secrets → `secrets-cli` seals sops `<app>-user-env` → chart `extraEnvFrom` → pod auto-rolls - plat/_app-template#1 (10010fda) — `sync-env` workflow + auto-roll - plat/agents#3 (bbe30613) — dev-scoped secrets injected into the builder (#15, closed alongside) - plat/mcp#3 (5d2db986) + plat/agents#5 (6ae7681a) + PR #18 (460a9dd4) — the #16 credential boundary that makes the scoping enforceable (red-teamed) - hardening tail: SEC-1 PR #52 (age-key backup/rotation), SEC-2 (plat/mcp#4 + plat/_app-template#2, actor attribution), SEC-3 PR #54 (threat model) **Behavior verified live:** end-to-end on real apps (weather; wb-rob2 clockface first-try); today's wb-gate daughter: `rotate_age_key` preserves a live app secret, old key decrypts nothing. **Backend note:** the body suggested Vault; the shipped model is sops + Forgejo-native (Actions secrets as the write surface, fork-resealing preserves sovereignty) — rationale in the SEC-3 threat model. Open PR #9 carries the older Vault *proposal* for this issue (no closing keyword — safe); treat it as superseded. Remaining tightenings live on their own issues: #13 (FQDN egress), #17 (observability), #42/#43 (policy Enforce flip).

plat closed this issue

2026-07-02 02:35:41 +00:00

plat referenced this issue

2026-07-02 13:37:37 +00:00

🐤 App-building health canary — continuous validation + regression fixes (orchestration epic) #69