From de9d229cfa9df2a5208d39b41254a42467b722e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Sat, 22 Aug 2026 18:02:55 +0000 Subject: [PATCH] todo: review the secret store built overnight Co-Authored-By: Claude Fable 5 --- TODO.md | 6 +-- ...iew-the-officer-secret-store-built-last.md | 42 +++++++++++++++++++ 2 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 todo/waiting-on-owner/review-the-officer-secret-store-built-last.md diff --git a/TODO.md b/TODO.md index 39f5386a..d4684647 100644 --- a/TODO.md +++ b/TODO.md @@ -20,7 +20,7 @@ the owner's OS user and can never be granted. Indirection there really is accide ## Themes -**87 open, 25 closed**, across 29 themes. +**88 open, 25 closed**, across 29 themes. | Theme | Open | Closed | | ------------------------------------------------------------------------------------------ | ---- | ------ | @@ -51,7 +51,7 @@ the owner's OS user and can never be granted. Indirection there really is accide | [Tooling — the list about the list](todo/tooling/) | 1 | 0 | | [Transmission](todo/transmission/) | 6 | 0 | | [URL state — routing, query strings and selection](todo/url-state/) | 4 | 0 | -| [Waiting on the owner to run it](todo/waiting-on-owner/) | 2 | 0 | +| [Waiting on the owner to run it](todo/waiting-on-owner/) | 3 | 0 | | [Workspaces & Panels](todo/workspaces-panels/) | 2 | 0 | ## Records — no items, kept for the reasoning @@ -69,7 +69,7 @@ the owner's OS user and can never be granted. Indirection there really is accide - `2026-08-22` **All keyboard shortcuts configurable** — [shell/all-keyboard-shortcuts-configurable](todo/shell/all-keyboard-shortcuts-configurable.md) - `2026-08-22` **Ctrl+? shows every keyboard shortcut in a modal** — [shell/ctrl-shows-every-keyboard-shortcut-in-a-modal](todo/shell/ctrl-shows-every-keyboard-shortcut-in-a-modal.md) - `2026-08-22` **Revamp the menus — spotlight, themes — toward an Omarchy-like shape** — [shell/revamp-the-menus-toward-an-omarchy-like-shape](todo/shell/revamp-the-menus-toward-an-omarchy-like-shape.md) +- `2026-08-22` **Review officer-secret-store, built overnight and untested by the owner** — [waiting-on-owner/review-the-officer-secret-store-built-last](todo/waiting-on-owner/review-the-officer-secret-store-built-last.md) - `2026-08-21` **No way to see which affordances are reaching your agents, or to turn one off** — [affordances/no-way-to-see-which-affordances-are-reaching](todo/affordances/no-way-to-see-which-affordances-are-reaching.md) - `2026-08-21` **Generalise it: deliver a turn to a named session, from anywhere in the backend** — [agent-delivery/generalise-it-deliver-a-turn-to-a-named](todo/agent-delivery/generalise-it-deliver-a-turn-to-a-named.md) - `2026-08-21` **The cost of resuming grows with the transcript** — [agent-delivery/the-cost-of-resuming-grows-with-the-transcript](todo/agent-delivery/the-cost-of-resuming-grows-with-the-transcript.md) -- `2026-08-21` **'An agent spawned by a background job is invisible in the interface'** — [background-jobs/a-spawned-agent-is-invisible-in-the-interface](todo/background-jobs/a-spawned-agent-is-invisible-in-the-interface.md) diff --git a/todo/waiting-on-owner/review-the-officer-secret-store-built-last.md b/todo/waiting-on-owner/review-the-officer-secret-store-built-last.md new file mode 100644 index 00000000..01313071 --- /dev/null +++ b/todo/waiting-on-owner/review-the-officer-secret-store-built-last.md @@ -0,0 +1,42 @@ +--- +id: waiting-on-owner/review-the-officer-secret-store-built-last +title: "Review officer-secret-store, built overnight and untested by the owner" +theme: waiting-on-owner +status: open +created: 2026-08-22 +date_source: stated +order: 3 +--- + +**Review `officer-secret-store`, built overnight and untested by the owner.** Filed 2026-08-22 at his +request: it was implemented last night, he has not had time to look at it, and it is waiting on him +rather than on more work. + +**It is NOT part of the platform and must not be merged into it.** A separate project, in a separate +repository, informed by what the platform does but deliberately its own thing: + +- **Working tree:** `/home/pastilhas/officer-dev/officer-secret-store` +- **Remote:** `git@gitea.officer.dev:officerdev/secret-store.git` +- Five commits, 16 TypeScript files across `src/` and `client/`, seven documents in `docs/`, two test + files (`access.test.ts`, `crypto.test.ts`). + +What it claims to be, from its own README: a secret store for a tailnet, where apps fetch credentials +over HTTP **holding no credential to do it** — the caller is identified by asking the local tailscaled +which node is at the source address, so nothing the client sends is consulted and a client cannot lie +about who it is. Access is a grant joining an app id to a node, and absence denies. It has **no npm +packages at runtime**, on the argument that a store defending against dependency-chain attacks cannot +have a dependency chain. + +Its own status line: *"working, tested end to end on a live tailnet, not yet running anything real."* +One commit records a live cross-machine check — `alpha` knew the app id and was refused — which is the +right shape of test for the claim above. + +Where to start, per the README: `docs/authentication.md`, which explains why the original design +(authenticating with the app id alone) cannot work. That is the reasoning the whole thing turns on, so +it is the part most worth a second pair of eyes. `docs/threat-model.md` and `docs/decisions.md` are the +other two that carry judgement rather than description. + +Related but distinct: the platform's own `docs/secret-store.md` is a **design, not built** — moving the +encryption and signing keys out of `.env` into a SQLite store on this machine. Whether that design is +now answered by this project, or stays separate, is a question for the review rather than an assumption +either way.