`consensus/secrets-manager.md`

32 lines

# Consensus — secrets-manager
Generated 2026-04-30T23:48:02-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `audit-2026-04-30.txt:1`: audit found `307` secret-looking leaks across projects/skills; current manager records the blast radius but does not remediate it. Rotate exposed keys, delete hardcoded copies, then rerun audit until clean.
- `auto-ingest.sh:31` + `auto-ingest.sh:51`: import failures are swallowed with `|| true`, then the changed hash is committed; bad/partial ingests can be silently skipped forever. Only write state after a successful import; log and exit nonzero on failure.
- `auto-ingest.sh:42-44`: every qualifying changed desktop file can background-launch `run-all-stages.sh`; no lock/idempotency guard. Add a lockfile or launchd `KeepAlive`/single-flight guard and record last fired input hash.
- `cli.js:68` + `cli.js:104`: `StrictHostKeyChecking=accept-new` while pushing secrets to remote root hosts risks trusting the wrong first-seen host. Pin host keys in `known_hosts` and fail closed.
- `routes.json:184-202`, `routes.json:301-319`, `routes.json:321-340`: prod API keys are routed directly to `root@45.61.58.125`. Use a restricted deploy user and least-privilege remote path ownership.

## Round-1 applied
## Applied
- None — no P0/P1 item in `CODEX_REVIEW.md` matched the approved autonomous safe-fix set closely enough to edit without broader operational risk.

## Still deferred for Steve
- P0 — `audit-2026-04-30.txt:1` — 307 secret-looking leaks across external projects/skills — requires secret rotation and cleanup outside this project.
- P0 — `auto-ingest.sh:31` / `auto-ingest.sh:51` — failed imports are swallowed before state hash is saved — reliability behavior change outside approved safe list.
- P0 — `auto-ingest.sh:42` — pipeline can be launched repeatedly without a lock — needs owner decision on launch semantics/idempotency.
- P0 — `cli.js:68` / `cli.js:104` — SSH accepts first-seen host keys — needs host key pinning details from Steve.
- P0 — `routes.json:198` / `routes.json:315` / `routes.json:336` — prod secrets fan out to remote `root` — needs deploy user and remote ownership changes.
- P1 — `cli.js:225` / `cli.js:257` — batch import exits on first invalid token — control-flow refactor not in approved safe list.
- P1 — `clipboard-watcher.launchd.err:1` / `supervisor.log:23` — Desktop access is blocked under launchd — needs Full Disk Access or workflow relocation.
- P1 — `clipboard-watcher.log:6` / `clipboard-watcher.sh:36` / `auto-ingest.sh:31` — inconsistent Node executable path — environment/install decision needed.
- P1 — `cli.js:33` / `cli.js:59` / `cli.js:210` — writes are non-atomic — broader file-write helper change not in approved safe list.
- P1 — `cli.js:64` — remote read SSH failure is treated as empty env — behavior change risks remote overwrite semantics.
- P1 — `clipboard-watcher.sh:60` — prefixless clipboard token classifiers may verify arbitrary strings — needs UX decision for confirmation/context.
- P1 — `cli.js:312` — audit skips all `.env` files globally — needs policy for managed vs committed env files.