# agent-harness secret lanes

Canon: `binky-control/integrations/executor-worker-secrets.md`.
OpenBao paths / policies: `railiance-platform/docs/workload-kv-access-lanes.md`.

**Never paste secret values into chat, Git, hub events, or this wiki.**

## Lane 1 — LLM provider (reuse)

Catalog: `openrouter-llm-connect`. No new secret. Harness reuses the
activity-core llm-connect provider key path.

## Lane 2 forgejo deploy key

Catalog: `agent-harness-forgejo-deploy`

| Item | Value |
| --- | --- |
| Host path (private key) | `~/.local/agent-harness/ssh/forgejo-deploy` on railiance01 |
| OpenBao path | `platform/workloads/agent-harness/forgejo-deploy-key` |
| Fields | `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY` |
| Policy | `workload-kv-read-agent-harness-forgejo` |
| SSH alias | `forgejo-agent-harness` (port 30022) |
| Repos (write deploy key) | `coulomb/executor-sandbox` first; add `binky-control` at cutover |

### Worker checklist

1. Confirm private key mode `600` under `~/.local/agent-harness/ssh/`.
2. `ssh -p 30022 -i ~/.local/agent-harness/ssh/forgejo-deploy -T git@forgejo.coulomb.social`  
   expects deploy-key success message (no shell).
3. Push only to granted repos (sandbox until cutover).

## Lane 3 mail approle

Catalog: `agent-harness-binky-mail-approle`

| Item | Value |
| --- | --- |
| AppRole | `agent-harness-binky-mail` |
| Token policy | `workload-kv-read-binky-company-email-imap` (existing; no widen) |
| Host dir | `~/.local/agent-harness/approle-binky-mail/` (`role_id`, `secret_id`, mode 600) |
| Env | `EXECUTOR_APPROLE_DIR` (see `~/.local/agent-harness/env`) |
| Secret path | `tenants/binky/company-email/imap` |

### Worker checklist

1. `source ~/.local/agent-harness/env`
2. Login with role_id/secret_id → short-lived token (ttl 15m).
3. `bao kv get -field=IMAP_USERNAME|IMAP_PASSWORD …` — use only in process env;
   never print.
4. Negative: same token must **not** read unrelated KV (e.g. forgejo-admin).