Task 3 report — one secret bundle for local services

Status

Complete. Local pgvector bootstrap, reconciliation, migration, and preprocess services now mount only /run/secrets/thothii.secrets. deploy/vector/secret-policy.sh validates the whole bundle (allowlist, duplicate/empty/unknown keys, comments/blank lines, mode and symlink policy) and returns only the requested value. The core entrypoint exposes DWH/vector/CA values to the harness and materializes short-lived 0600 password files for workspace resolution.

TDD evidence

RED: ./scripts/test-preprocess-compose-config.sh failed on the pre-existing vector_reader_password Compose secret declaration.
GREEN: the same command passes after the bundle conversion and verifies local-vector workspace interpolation and shared secret mounts.
./scripts/test-vector-secret-policy.sh covers comments/blank lines and rejects an unrelated duplicate key.

Verification

./scripts/test-vector-secret-policy.sh — passed.
./scripts/test-preprocess-compose-config.sh — passed.
./scripts/test-vector-backup-restore-safety.sh — passed.
./scripts/test-default-compose.sh — passed.
./scripts/test-container-deployment.sh — passed.
./scripts/local-vector-smoke.sh — passed with real Docker (bootstrap rotation, role reconciliation, migration, persistence and restart).
./scripts/preprocess-smoke.sh — passed with real Docker (unchanged rerun, mutation, DWH job, ACTIVE publication and cleanup).
./scripts/preprocess-smoke.sh --cleanup-failure — passed.
git diff --check and sh -n gates — passed.

Critical review fix

buildPiChildEnv now removes THT_DWH_API_KEY, THT_VEC_API_KEY, THT_VEC_WRITE_API_KEY, THT_SSL_CA, THT_CA, and their file metadata before spawning Pi. A regression test proves that neither secret values nor bundle/file metadata are inherited by the Pi child.

Commits

70a19f2 feat(compose): use one secret bundle for local services
d500563 fix(security): scrub deployment secrets from Pi child
8518a73 fix(security): scrub raw deployment secret values

Concern

The rotation helper retains its old/new scratch-file CLI contract; smoke tests keep those files outside Compose and mount only the bundle.

2.2 KiB Raw Blame History