# secrets-engine

Headless, multi-application, multi-tenant secrets workflow and automation layer
for approved secret custody, delivery, and lifecycle work across build, test,
and production stages.

OpenBao remains the custody and enforcement backend. `secrets-engine` owns the
operator and agent interaction model: catalog, decision checks, plan/apply,
safe provisioning, verification, delivery, evidence, rotation, and deactivation.

## Start Here

- [INTENT.md](INTENT.md) - why this repository exists.
- [ProductRequirementsDocument.md](ProductRequirementsDocument.md) - product
  requirements and MVP scope.
- [NetKingdom security infrastructure boundary pointer](docs/netkingdom-security-infrastructure.md)
  - points to the canonical document in `net-kingdom/docs/`, covering
  responsibilities and interactions with OpenBao, flex-auth, user-engine,
  ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.
- [Bootstrap MVP workplan](workplans/SECRETS-WP-0002-bootstrap.md) - first
  implementation plan after State Hub bootstrap.

## Core Direction

The MVP proves the `whynot-design-npm-publish` lane end to end:

1. describe the lane in a non-secret catalog (`catalog/`);
2. verify an approved decision (State Hub or local fixture);
3. apply OpenBao policy/auth metadata through a stage-aware role;
4. provision and verify the value without printing it;
5. run a workload command through safe exec-time delivery.

Target command shape:

```bash
secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
```

## Quickstart

```bash
uv venv && uv pip install -e ".[dev]"
source .venv/bin/activate
secrets-engine catalog list

# Run the whole pilot chain live against a throwaway OpenBao dev server:
SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh
```

- CLI reference: [docs/cli.md](docs/cli.md)
- Stage roles & bootstrap tokens: [docs/openbao-stage-roles.md](docs/openbao-stage-roles.md)
- ops-warden routing contract: [docs/ops-warden-routing-contract.md](docs/ops-warden-routing-contract.md)
- Hardening backlog (exit bootstrap mode): [docs/hardening-backlog.md](docs/hardening-backlog.md)

The implementation is a Python package (`src/secrets_engine/`). OpenBao is
reached only through the `bao` CLI adapter (`openbao.py`); the rest of the code
speaks in lanes and guarded plans.

## Security Rules

- Do not put raw secret values in Git, State Hub, chat, prompts, issue comments,
  workplans, or normal logs.
- OpenBao is the backend custody and audit authority.
- Build, test, and production have separate policy boundaries.
- Production actions require approved decisions except explicit break-glass
  flows.
- Temporary bootstrap OpenBao credentials must live outside repos, use mode
  0600, be revocable, and be removed after narrower auth is working.