Apply P15: secrets from a systemd credential, the environment or a file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-23 17:43:08 -07:00
parent 4a510fde08
commit eab2fbdc55
2 changed files with 7 additions and 5 deletions
@@ -209,8 +209,11 @@ Files are the source of truth. SQLite is allowed only for rebuildable indexes an
 - `audit/*.jsonl` — hash-chained
 - `broker/sessions/<id>.json` — each session's taint and untrusted flag, written only by
  `brokerd`; it can be rebuilt from the audit log's `result` records
- Secrets: behind a `SecretStore` trait. v0 backend is an encrypted file whose key is not stored
-  beside it. No plaintext secrets on disk, none in config, none in the repo.
+- Secrets: behind a `SecretStore` trait with three backends, chosen per secret: a systemd credential
+  (encrypted at rest; the key is the host's TPM and host key, not stored beside it), an environment
+  variable, or a file that only the owner can read. The credential backend is the default; the
+  other two put the secret in plaintext, in the process environment or on disk, and are for
+  portability; a file secret prints a warning at startup. None in config, none in the repo.

 ## Code constraints