Extracted from archived corpus. See archive/compiler-v1/ for original.

sw.std.secrets¶

Status: draft (recovered)
Sources: root AGENTS.md §7; 01 - Pipeline Management/AGENTS.md §9; Lab/Portfolio AGENTS

Guardrails¶

Never commit secrets, API keys, or private keys to git.
Canonical store: Bitwarden Secrets Manager (EU), project workspaces.
Unlock with the Python secret-gate CLI (uv tool install from Konstant-Ventures/secret-gate); use cached session when present. On Windows use pwsh 7.2+, not PowerShell 5.1. See docs/guides/connecting.md and Operate tooling.
Prefer generic reusable key names (VPS_SSH_KEY, not my-app-vps-ssh-key).
Before creating a secret, bws secret list and reuse if suitable.
New secrets: create placeholder → Hector updates value in vault UI.
Operate DNS/tunnel secrets (CLOUDFLARE_API_TOKEN, HETZNER_DNS_TOKEN, …) follow the same rule — never commit; export only via secret-gate.

Secret	Purpose
`VPS_HOST`	Tailscale IP of deploy host (script may hardcode mesh IP)
`VPS_SSH_KEY`	Deploy SSH private key
`TAILSCALE_AUTHKEY`	Tailscale auth for Actions

Set after promotion via add-repo-secrets.ps1 in the same shell as secret-gate.