todo: review the secret store built overnight

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-22 18:02:55 +00:00
parent cabc4825ef
commit de9d229cfa
2 changed files with 45 additions and 3 deletions
@@ -0,0 +1,42 @@
+---
+id: waiting-on-owner/review-the-officer-secret-store-built-last
+title: "Review officer-secret-store, built overnight and untested by the owner"
+theme: waiting-on-owner
+status: open
+created: 2026-08-22
+date_source: stated
+order: 3
+---
+
+**Review `officer-secret-store`, built overnight and untested by the owner.** Filed 2026-08-22 at his
+request: it was implemented last night, he has not had time to look at it, and it is waiting on him
+rather than on more work.
+
+**It is NOT part of the platform and must not be merged into it.** A separate project, in a separate
+repository, informed by what the platform does but deliberately its own thing:
+
+- **Working tree:** `/home/pastilhas/officer-dev/officer-secret-store`
+- **Remote:** `git@gitea.officer.dev:officerdev/secret-store.git`
+- Five commits, 16 TypeScript files across `src/` and `client/`, seven documents in `docs/`, two test
+  files (`access.test.ts`, `crypto.test.ts`).
+
+What it claims to be, from its own README: a secret store for a tailnet, where apps fetch credentials
+over HTTP **holding no credential to do it** — the caller is identified by asking the local tailscaled
+which node is at the source address, so nothing the client sends is consulted and a client cannot lie
+about who it is. Access is a grant joining an app id to a node, and absence denies. It has **no npm
+packages at runtime**, on the argument that a store defending against dependency-chain attacks cannot
+have a dependency chain.
+
+Its own status line: *"working, tested end to end on a live tailnet, not yet running anything real."*
+One commit records a live cross-machine check — `alpha` knew the app id and was refused — which is the
+right shape of test for the claim above.
+
+Where to start, per the README: `docs/authentication.md`, which explains why the original design
+(authenticating with the app id alone) cannot work. That is the reasoning the whole thing turns on, so
+it is the part most worth a second pair of eyes. `docs/threat-model.md` and `docs/decisions.md` are the
+other two that carry judgement rather than description.
+
+Related but distinct: the platform's own `docs/secret-store.md` is a **design, not built** — moving the
+encryption and signing keys out of `.env` into a SQLite store on this machine. Whether that design is
+now answered by this project, or stays separate, is a question for the review rather than an assumption
+either way.