From 9db703b7da6f9d9528670e23ce77556b39d91ea0 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 11 Aug 2026 21:43:41 -0700 Subject: [PATCH] =?UTF-8?q?claude:=20vault=20is=20the=20credential=20sourc?= =?UTF-8?q?e=20of=20truth=20=E2=80=94=20pull=20creds=20FROM=20it=20too,=20?= =?UTF-8?q?not=20just=20store?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extend the secrets directive per operator (2026-08-11): store durable secrets in the vault AND 'secret get' the creds a task needs from it rather than reading on-disk copies. --- home_root/.claude/CLAUDE.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/home_root/.claude/CLAUDE.md b/home_root/.claude/CLAUDE.md index 04bd5c7..4d25027 100644 --- a/home_root/.claude/CLAUDE.md +++ b/home_root/.claude/CLAUDE.md @@ -548,10 +548,13 @@ note says otherwise. On other boxes, check first.) value), `secret list [--prefix P]`, `secret backfill [--dry-run]` (scans THIS box's `~/development/*/{env.sh,.env}` + `~/.config` creds and upserts each). Items are hostname-namespaced (`/…`); small text → item note, small binary - → base64 hidden field, >6000 B → a bw attachment. **STANDING DIRECTIVE: store - durable credentials in the vault.** Any token / API key / cert / env-secret worth - keeping — not ephemeral, doesn't belong in git — should be `secret put` into the - vault so it survives and is findable, never left single-copy on a box. The one + → base64 hidden field, >6000 B → a bw attachment. **STANDING DIRECTIVE (operator, + 2026-08-11): the vault is the credential source of truth — store durable secrets + in it AND pull the creds you need FROM it.** Any token / API key / cert / env-secret + worth keeping — not ephemeral, doesn't belong in git — should be `secret put` into + the vault so it survives and is findable, never left single-copy on a box; and when + a task needs a credential (e.g. a gitea token to create a repo), **`secret get` it + from the vault** rather than reading an on-disk copy where practical. The one exception is `bootstrap.env` itself (secrets-zero — it unlocks the vault, so it can't live inside it; keep it `0600`). **Not a fleet service / no daemon** — each new dev box duplicates this stack against its own local secrets (setup steps in