[Epic] Secrets management hardening #1654

New issue

Copy link

New issue

Copy link

Open

3 / 93 of 9 issues completed

Open

[Epic] Secrets management hardening#1654

3 / 93 of 9 issues completed

Copy link

Description

kriszyp

opened on Jul 7, 2026

Issue body actions

Tracking epic for secrets-management hardening work. Cross-reference the broader secrets-management design record (Confluence SD 823623682).

---

Filed by Claude (Opus 4.8), issue-backlog triage & grouping pass.

Reactions are currently unavailable

Activity

1. kriszyp

   added sub-issues on Jul 7, 2026

   • deploy_component: resolve registry auth from the secrets store (rollback/redeploy/clone re-execution) #1551
   • Secrets hardening: context-bound envelopes (enc:v2), key rotation walk, audit stream #1552
   • Secrets store: sensitive:false plaintext rows (readable non-secret config values) #1588
   • Root harper-config env: block (instance-wide literals, enc: envelopes, and store declarations) #1589
2. kriszyp

   added sub-issues on Aug 6, 2026

   • [security] Config file (which may hold model-backend apiKeys and other credentials) written with default world-readable permissions #1925
   • [security] Plaintext passwords retained indefinitely in an unbounded in-memory cache keyed by the cleartext password #1926
3. kriszyp

   removed a sub-issue on Aug 7, 2026

   • Secrets store: sensitive:false plaintext rows (readable non-secret config values) #1588
4. kriszyp

   added a sub-issue on Aug 7, 2026

   • CLI: harper deploy --setup — one-command deploy-key provisioning #1778
5. kriszyp

   removed a sub-issue on Aug 7, 2026

   • Root harper-config env: block (instance-wide literals, enc: envelopes, and store declarations) #1589
6. kriszyp

   set

   Priority

   to

   P1

   on Sep 21, 2026
7. kriszyp

   added a sub-issue on Sep 21, 2026

   • add_ssh_key / update_ssh_key private keys reach the operations log: key is missing from the processLocalTransaction strip list #2199
8. Devin-Holland

   added a sub-issue on Sep 24, 2026

   • Secret custody registers after installApplications(), so sealed enc:v1 SSH keys are always skipped during boot-time component installs #2780
9. DavidCockerill

   added a sub-issue on Oct 7, 2026

   • agent: config-file credentials and read_log output still reach the model after #3041 — mask credential values in agent reads #3097

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

Labels

No labels

No labels

Type

No type

Fields

Priority

P1

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

• Open in GitHub Copilot app