platform/todo/waiting-on-owner/review-the-officer-secret-store-built-last.md

id, title, theme, status, created, date_source, order

id	title	theme	status	created	date_source	order
waiting-on-owner/review-the-officer-secret-store-built-last	Review officer-secret-store, built overnight and untested by the owner	waiting-on-owner	open	2026-08-22	stated	3

Review officer-secret-store, built overnight and untested by the owner. Filed 2026-08-22 at his request: it was implemented last night, he has not had time to look at it, and it is waiting on him rather than on more work.

It is NOT part of the platform and must not be merged into it. A separate project, in a separate repository, informed by what the platform does but deliberately its own thing:

• Working tree: /home/pastilhas/officer-dev/officer-secret-store
• Remote: git@gitea.officer.dev:officerdev/secret-store.git
• Five commits, 16 TypeScript files across src/ and client/, seven documents in docs/, two test files (access.test.ts, crypto.test.ts).

What it claims to be, from its own README: a secret store for a tailnet, where apps fetch credentials over HTTP holding no credential to do it — the caller is identified by asking the local tailscaled which node is at the source address, so nothing the client sends is consulted and a client cannot lie about who it is. Access is a grant joining an app id to a node, and absence denies. It has no npm packages at runtime, on the argument that a store defending against dependency-chain attacks cannot have a dependency chain.

Its own status line: "working, tested end to end on a live tailnet, not yet running anything real." One commit records a live cross-machine check — alpha knew the app id and was refused — which is the right shape of test for the claim above.

Where to start, per the README: docs/authentication.md, which explains why the original design (authenticating with the app id alone) cannot work. That is the reasoning the whole thing turns on, so it is the part most worth a second pair of eyes. docs/threat-model.md and docs/decisions.md are the other two that carry judgement rather than description.

Related but distinct: the platform's own docs/secret-store.md is a design, not built — moving the encryption and signing keys out of .env into a SQLite store on this machine. Whether that design is now answered by this project, or stays separate, is a question for the review rather than an assumption either way.