/goal /ultracode-workflows [SEC-3] secrets threat-model + reviewer FAQ (no store code changes) #45

New issue

Closed

opened 2026-07-01 02:03:53 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:53 +00:00

Owner

Track/Wave: SEC-3 · Wave G5 · Size S
Repos: mitosis-docs
Depends on: SEC-1, SEC-2

Why

A reviewer unfamiliar with the code should be able to state what decrypts what, who sees plaintext and when, and why Vault is deferred — without reading source.

Scope

One doc: what is sealed under the one key and why (sovereignty invariant); the write-only Forgejo-secrets rationale and its implication (platform sees plaintext only transiently in the sync CI job); the dev/prod scope trust boundary; the post-SEC-1 rotation/backup posture; the explicit Vault NON-decision (adds stateful risk without removing the age-key SPOF) plus the trigger to revisit (multi-operator quorum, secret TTLs, dynamic creds).

Acceptance

A reviewer can read the single doc and correctly state what decrypts what, who sees plaintext and when, how rotation/backup work, and why Vault is deferred — without reading source.

Notes

Doc only.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `SEC-3` · Wave **G5** · Size **S** **Repos:** `mitosis-docs` **Depends on:** SEC-1, SEC-2 ## Why A reviewer unfamiliar with the code should be able to state what decrypts what, who sees plaintext and when, and why Vault is deferred — without reading source. ## Scope One doc: what is sealed under the one key and why (sovereignty invariant); the write-only Forgejo-secrets rationale and its implication (platform sees plaintext only transiently in the sync CI job); the dev/prod scope trust boundary; the post-SEC-1 rotation/backup posture; the explicit Vault NON-decision (adds stateful risk without removing the age-key SPOF) plus the trigger to revisit (multi-operator quorum, secret TTLs, dynamic creds). ## Acceptance A reviewer can read the single doc and correctly state what decrypts what, who sees plaintext and when, how rotation/backup work, and why Vault is deferred — without reading source. ## Notes **Doc only.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:53 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:53 +00:00

plat added a new dependency

2026-07-01 02:04:52 +00:00

#26 /goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling

plat added a new dependency