mosaicstack/stack
21
0
Fork 1
Code Issues 339 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

chore(framework): canonize Vault-as-SSOT + ESO-default secrets policy #519

Merged
jason.woltje merged 3 commits from chore/canonize-vault-secrets-policy into main 2026-06-11 19:07:01 +00:00
Conversation 0 Commits 3 Files Changed 5
+792
3 Commits
Author SHA1 Message Date
Mos worker f6b901dbca chore(format): prettier-normalize VAULT-SECRETS.md (table alignment + inline comments)
ci/woodpecker/pr/ci Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was successful
Details
2026-06-11 13:20:58 -05:00
Hermes AgentMos workerClaude Opus 4.7
 		0a224efb82 fix(framework): remediate Codex review findings in VAULT-SECRETS.md 
Two should-fix findings from automated Codex review:

1. Vault KV v2 policy path — add explicit path for exact top-level
   `secret/data/k3s/<app>` entry alongside the wildcard `/*` sub-path
   rule. Without the exact path, apps reading the top-level secret get
   permission denied from Vault KV v2 even with the wildcard.

2. Go envconfig example — remove unused `os` import from config.go
   snippet (os was only referenced in a comment). Move the main() usage
   to a separate clearly-labelled main.go block to make both snippets
   copy-paste compilable.

Both fixes mirrored to duplicate path:
  guides/ <-> packages/mosaic/framework/guides/

Co-Authored-By: Claude Opus 4.7 <[email protected]>
 2026-06-11 13:20:32 -05:00
Hermes AgentMos workerClaude Opus 4.7
 		e82163b532 chore(framework): canonize Vault-as-SSOT + ESO-default secrets policy 
Encodes operator-approved (Jason, 2026-05-22) secrets policy as binding
framework rules across all Mosaic agent sessions and projects.

Changes:
- STANDARDS.md: add "Secrets handling (HARD RULE)" subsection under
  Non-Negotiables — Vault as SSOT, ESO bridge as default, Direct-Vault
  opt-in only, forbidden ${VAR:-default} for required values, forbidden
  .env in prod, required startup schema validation
- VAULT-SECRETS.md: add four new sections — architecture decision matrix
  (ESO vs Direct-Vault), full ESO bridge worked example (Vault path +
  ExternalSecret + Deployment YAML + zod/pydantic/Go validators),
  Direct-Vault opt-in pattern (AppRole provisioning + ESO bootstrap
  for chicken-and-egg), and forbidden patterns CI lint targets
- BOOTSTRAP.md: add "Secrets Bootstrap" required subsection with
  checklist for new apps (Vault path, README docs, ExternalSecret,
  secretKeyRef, schema validator, Direct-Vault justification)

All duplicate file paths kept in sync (md5-equal pairs):
  guides/ <-> packages/mosaic/framework/guides/
  packages/mosaic/framework/defaults/STANDARDS.md (single copy in repo)

Co-Authored-By: Claude Opus 4.7 <[email protected]>
 2026-06-11 13:20:32 -05:00