chore(secrets): bump secretspec to v0.20, thread an audit reason, and stage an age-capable CLI (RIG-3320)

devenv.lock

@@ -426,7 +426,8 @@
         "go-overlay": "go-overlay",
         "hk": "hk",
         "nix2container": "nix2container",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "secretspec-nixpkgs": "secretspec-nixpkgs"
       }
     },
     "rust-overlay": {
@@ -450,6 +451,22 @@
         "type": "github"
       }
     },
+    "secretspec-nixpkgs": {
+      "locked": {
+        "lastModified": 1788549839,
+        "narHash": "sha256-kOrCcSIA6w9J1hX5DqHy2k9pDTJymExTsbV74U9UtCA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "17de0b976395537756f30a3e78f2f06e5cec89ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

devenv.nix

@@ -238,6 +238,21 @@ in
     pkgs.cloud-hypervisor
     pkgs.virtiofsd
     pkgs.passt
+  ]
+  # secretspec: the CLI the Go secrets write path spawns BY NAME for
+  # `set`/`delete` (go/internal/secrets/resolver.go's `cli` default), so the
+  # write path is unreachable unless this shell puts one on PATH. Resolved from
+  # the `secretspec-nixpkgs` input rather than this shell's own nixpkgs because
+  # that channel's rev still carries 0.14.0, which has no `age` provider
+  # compiled in — the encrypted-at-rest default the server-secret resolver
+  # writes through. This input's version matches the Go SDK pin in go/go.mod, so
+  # the read path (SDK + native lib) and the write path (this CLI) advance
+  # together; `internal/secrets` asserts both halves rather than assuming them.
+  # A dotted input reference, so it is appended OUTSIDE the parsed `with pkgs`
+  # literal (same reason as skopeo-nix2container: the toolchain-parity gate
+  # resolves every bare attr in that literal, including on macOS).
+  ++ [
+    inputs.secretspec-nixpkgs.legacyPackages.${pkgs.stdenv.system}.secretspec
   ];
 
   env = {

devenv.yaml

@@ -54,3 +54,20 @@ inputs:
     inputs:
       nixpkgs:
         follows: nixpkgs
+  # secretspec-nixpkgs: a SECOND nixpkgs, pinned by rev in devenv.lock, solely
+  # for the `secretspec` CLI the Go secrets write path spawns by name. The
+  # `age://` provider it needs to write encrypted-at-rest secrets was added in
+  # 0.17.0 (it is a default-on cargo feature), and the rolling channel
+  # this shell's own nixpkgs is locked to still resolves 0.14.0 — a build with
+  # no `age` backend compiled in at all, which fails a write with `Provider
+  # backend 'age' not found` rather than degrading. This input tracks the
+  # channel that carries a version matching the Go SDK pin (go/go.mod's
+  # secretspec module), so the read path (SDK) and the write path (CLI) move
+  # together instead of skewing across an independent seam. It deliberately
+  # does NOT `follows: nixpkgs` — following would defeat the entire purpose by
+  # collapsing it back onto the rev that lacks the provider. Consumed as a
+  # dotted attr in devenv.nix, OUTSIDE the parsed `with pkgs` packages literal,
+  # because the toolchain-parity gate resolves every bare attr in that literal
+  # (the same reason skopeo-nix2container sits outside it).
+  secretspec-nixpkgs:
+    url: github:NixOS/nixpkgs/nixpkgs-unstable

docs/designs/agent/compass-agent-container-runtime.md

@@ -711,7 +711,7 @@ repo manifest, no grants table). All types redact like `Credentials`
     generic channels; `SecretGH` rows carry `Host string` (default
     `github.com`) so T5 routes them to `GHCredentials.SetupScript`
     (Decision 3's gh placement), never the generic file path.
-  - `type Resolver interface { Resolve(ctx context.Context, reason string) ([]ResolvedSecret, error); Set(ctx context.Context, name, value string) error; Delete(ctx context.Context, name string) error }`
+  - `type Resolver interface { Resolve(ctx context.Context, reason string) ([]ResolvedSecret, error); Set(ctx context.Context, name, value, reason string) error; Delete(ctx context.Context, name string) error }`
     — `Resolve` resolves the **whole registry** (inject-all; a
     `names []string` parameter returns with the future grants seam);
     `Set`/`Delete` are the provider **write** path T7's

docs/designs/agent/compass-forks-reversal/design.md

@@ -85,7 +85,7 @@ the two, compass keeps building against the previous pinned rev.
 the fork's CLI is also invoked raw (`nix run path:../forks/<fork>#…`) in the
 raw-CLI call sites (six files, incl. `tools/agent-image-env-gate/index.ts`) that
 bypass the lock (see L1/L2 Interfaces). Today a single `path:` tree
-makes CLI-rev == module-rev by construction (`devenv.nix:442-445` names exactly
+makes CLI-rev == module-rev by construction (`devenv.nix:457-460` names exactly
 this as the reason for the pin shape). The flake-input side follows the internal
 monorepo's frozen default — `github:RigelBuild/<fork>` pinned via `devenv.lock` —
 but the six raw-CLI sites bypass that lock, so the reversal MUST separately
@@ -124,7 +124,7 @@ is compass's review point — not a mechanical path swap.
   (`"path": "../forks/devenv"`).
 - The fork's own CLI is invoked by path everywhere the image is built:
   `agent-image/moon.yml:44` (`command: 'nix run path:../forks/devenv#devenv --
-  container build agent'`), `agent-image/publish.sh:50-51`, `devenv.nix:461`
+  container build agent'`), `agent-image/publish.sh:50-51`, `devenv.nix:476`
   (`nix run path:../forks/devenv#devenv -- container copy agent`),
   `.github/workflows/ci.yml:812`, and
   `tools/agent-image-env-gate/index.ts:100` — the fail-closed image-env gate
@@ -405,7 +405,7 @@ Interfaces:
   - CLI invocations `nix run path:../forks/devenv#devenv` → `nix run
     github:RigelBuild/devenv/<rev>#devenv` (rev-pinned literal, same rationale
     as L1): `agent-image/moon.yml:44`, `agent-image/publish.sh:50-51`,
-    `devenv.nix:461`, `.github/workflows/ci.yml:812`,
+    `devenv.nix:476`, `.github/workflows/ci.yml:812`,
     `tools/agent-image-env-gate/index.ts:100`.
 - Deletes: `forks/devenv/` (incl. `.upstream-sync`, `moon.yml`);
   `.moon/workspace.yml:78` (`devenv-fork: 'forks/devenv'`);
@@ -419,7 +419,7 @@ Interfaces:
 - Comment sweep (fork-path references in prose): `agent-image/devenv.nix:7`,
   `agent-image/toolchain.nix:96`, `agent-image/moon.yml:5,38` (the
   `nix run path:../forks/devenv#devenv` example and the `path:../forks/*`
-  cwd-rationale comment, adjacent to the repointed CLI), `devenv.nix:110,443`,
+  cwd-rationale comment, adjacent to the repointed CLI), `devenv.nix:110,458`,
   `tools/agent-image-env-gate/env-check.ts:8`, `index.ts:15`, and
   `moon.yml:10,41` (all cite `forks/devenv/...` or `path:../forks/*`),
   `apps/ui/.env.development:30-32` (cites
@@ -433,7 +433,7 @@ Interfaces:
   surface" — the flake is now fetched from `RigelBuild/devenv` at a pinned rev,
   not an in-repo file).
 - Gate: `moon run agent-image:build` green; `dogfood:agent-image`
-  (`devenv.nix:456-464`) loads the image; agent container smoke ($HOME =
+  (`devenv.nix:471-479`) loads the image; agent container smoke ($HOME =
   `/home/agent`, nix usable) — the exact property the patch protects; the OQ2
   pin shape applied consistently with L1.
 
@@ -573,7 +573,7 @@ Interfaces:
    imminent and named.
 2. **Rev-pinned CLI literals vs one lockfile for the raw `nix run` invocations**
    (`agent-image/publish.sh:32,50-51`, `agent-image/moon.yml:44`,
-   `devenv.nix:461`, `ci.yml:812`, `publish-agent-image.yml:139,160`,
+   `devenv.nix:476`, `ci.yml:812`, `publish-agent-image.yml:139,160`,
    `tools/agent-image-env-gate/index.ts:100,118`) —
    **LOAD-BEARING, but narrower than first framed.** The *flake-input* half is
    settled: the internal monorepo's prior art froze the nix-flake-input class as
@@ -586,7 +586,7 @@ Interfaces:
    compass invokes the fork CLI raw at the six sites above, which bypass
    `devenv.lock` entirely.
    Today a single `path:` tree makes the CLI rev and the locked
-   module-set rev identical by construction (`devenv.nix:442-445` names this as
+   module-set rev identical by construction (`devenv.nix:457-460` names this as
    the reason for the pin shape; the frozen dogfood-loop record makes the same
    argument, `docs/designs/platform/compass-dogfood-loop/design.md:225-229`).
    Scattering a `github:…/<rev>` literal across those six lockfile-bypass sites

docs/designs/agent/compass-forks-reversal/oq-resolutions.md

@@ -85,7 +85,7 @@ raw invocation.
 Impact on **L1** (`design.md:348-386`) and **L2** (`design.md:388-435`):
 
 - The six raw-`nix run` sites — `agent-image/publish.sh:32,50-51`,
-  `agent-image/moon.yml:44`, `devenv.nix:461`, `.github/workflows/ci.yml:812`,
+  `agent-image/moon.yml:44`, `devenv.nix:476`, `.github/workflows/ci.yml:812`,
   `.github/workflows/publish-agent-image.yml:139,160`,
   `tools/agent-image-env-gate/index.ts:100,118` — install and invoke the fork
   tools by explicit name from the `github:RigelBuild/{devenv,nix2container}`

docs/designs/infra/ci/compass-agent-image-publish/design.md

@@ -186,7 +186,7 @@ silent-staleness failure the doctrine targets. What it *does* buy:
   `cancel-in-progress: false` group, which a separate workflow gives cleanly.
 - **Off the hot path, not a required check.** The image closure is the heavy
   nix build that motivates CI's 90m timeout (`ci.yml:93-95`); the dogfood task
-  is opt-in for the same reason (`devenv.nix:340-348`). A separate workflow
+  is opt-in for the same reason (`devenv.nix:355-363`). A separate workflow
   keeps PR latency untouched, and a publish flake never reds the required merge
   gate.
 - **Failure ownership.** `agent-image/` is not a moon project, so the gate
@@ -325,7 +325,7 @@ visibility ever changes.
 - Comments and docs explain non-obvious WHY (compass `AGENTS.md`).
 - The image build stays OFF the hot `up`/PR path: publish is main-only +
   `workflow_dispatch`, mirroring the opt-in `dogfood:agent-image` posture
-  (`devenv.nix:345-348` — "NOT wired `after` into up — the image closure is
+  (`devenv.nix:360-363` — "NOT wired `after` into up — the image closure is
   large").
 - Reproducibility: the published `:git-<sha>` and the local dogfood load are
   copies of the SAME nix derivation — both flow through
@@ -349,7 +349,7 @@ locally (with a PAT-backed `skopeo login`) and from CI identically.
 
 - Build: `nix run path:../forks/devenv#devenv -- container build agent`
   executed with cwd `agent-image/` (the same fork-pinned invocation shape as
-  `dogfood:agent-image`, `devenv.nix:349-354`); capture the printed image-spec
+  `dogfood:agent-image`, `devenv.nix:364-369`); capture the printed image-spec
   store path.
 - Skopeo: `nix run path:../forks/nix2container#skopeo-nix2container --`
   (exposed at `forks/nix2container/flake.nix:31`; `pkgs.skopeo`'s

docs/designs/infra/ci/compass-devenv-source-dry/design.md

@@ -18,8 +18,8 @@ grep for `15a81f3e` this session): `agent-image/moon.yml:45` (`command: 'nix run
 github:RigelBuild/devenv/15a81f3e…#devenv -- container build agent'`),
 `agent-image/publish.sh:62` (`BUILD_OUT="$(nix run
 github:RigelBuild/devenv/15a81f3e…#devenv -- container build agent)"`),
-`devenv.nix:537` (the `dogfood:agent-image` task — whose own comment,
-devenv.nix:519-521, claims the pin "cannot diverge from the fork source the
+`devenv.nix:552` (the `dogfood:agent-image` task — whose own comment,
+devenv.nix:534-536, claims the pin "cannot diverge from the fork source the
 agent-image module set is pinned to", precisely the drift this record proves IS
 possible), and `tools/agent-image-env-gate/index.ts:103` (the env gate's `nix
 run … container build`, which runs in the CI moon graph:
@@ -210,7 +210,7 @@ renovate.yml tracks the root lock. bun is on PATH in this job
 (ci.yml:1032-1042's toolchain bootstrap precedes 1153).
 
 **The four other hand-pins** (`agent-image/moon.yml:45`,
-`agent-image/publish.sh:61-62`, `devenv.nix:537`, and
+`agent-image/publish.sh:61-62`, `devenv.nix:552`, and
 `tools/agent-image-env-gate/index.ts:103`) are the same drift class but
 different execution contexts (moon and devenv.nix command strings can't shell
 out to compose a flakeref; publish.sh runs in a workflow with no bun bootstrap,
@@ -347,7 +347,7 @@ comment block (ci.yml:1120-1122) to describe lock-resolution.
 
 Convert all four (own PR, after T2/T3):
 
-- `agent-image/moon.yml:45` and `devenv.nix:537` — command strings that cannot
+- `agent-image/moon.yml:45` and `devenv.nix:552` — command strings that cannot
   compose a flakeref inline; each becomes a small wrapper invocation (a
   `script:`/wrapper entry point that runs `bun … devenv-cli … --mode flakeref`
   then `nix run "$src"`; exact mechanism at impl).
@@ -365,7 +365,7 @@ Convert all four (own PR, after T2/T3):
   - Consumes: `--lock agent-image/devenv.lock --mode flakeref` (shell sites) or
     the `core.ts` exports directly (env-gate).
   - Produces: `agent-image/moon.yml:45`, `agent-image/publish.sh:61` (log) and
-    `:62` (executable), `devenv.nix:537`,
+    `:62` (executable), `devenv.nix:552`,
     `tools/agent-image-env-gate/index.ts:103` all free of literal revs.
 
 ### T2b — (from Alternative (f)) Repo-wide literal-devenv-rev gate
@@ -461,7 +461,7 @@ automatically.
 - [ ] T3 — ci.yml:1153 seed step → resolve via tool
       (`--lock agent-image/devenv.lock --mode flakeref`) + `nix run "$src"`
 - [ ] T2a — (ruled RD-2) de-pin the four remaining sites via the tool:
-      agent-image/moon.yml:45, publish.sh:61 (log) + :62 (exec), devenv.nix:537,
+      agent-image/moon.yml:45, publish.sh:61 (log) + :62 (exec), devenv.nix:552,
       tools/agent-image-env-gate/index.ts:103
 - [ ] T2b — repo-wide literal-devenv-rev gate with a day-one carve-out for
       docs/designs/** + comment/log sites (kills the class; lands after T2a)
@@ -522,8 +522,8 @@ source-of-truth lock, not a hand-pin):
 1. `ci.yml:1153` — dogfood-e2e seed (task T3).
 2. `agent-image/moon.yml:45` — `build.command` (task T2a).
 3. `agent-image/publish.sh:62` — publish build (task T2a).
-4. `devenv.nix:537` — the `dogfood:agent-image` task, whose own comment
-   (`devenv.nix:519-521`) claims the pin "cannot diverge from the fork source
+4. `devenv.nix:552` — the `dogfood:agent-image` task, whose own comment
+   (`devenv.nix:534-536`) claims the pin "cannot diverge from the fork source
    the agent-image module set is pinned to" — a claim this record disproves.
 5. `tools/agent-image-env-gate/index.ts:103` — the env gate's `nix run …
    container build`, which runs in the CI moon graph

docs/designs/infra/ci/compass-dogfood-e2e/design.md

@@ -191,7 +191,7 @@ A new `go/e2e` (name final at implementation) package with a fixture that:
 
 **Real agent image, not alpine.** The capstone's `Config.AgentImage` is
 `compass-agent:latest` built+loaded into containers-storage by the dogfood-loop
-task (`devenv.nix:349-354` `dogfood:agent-image`, opt-in). Because
+task (`devenv.nix:364-369` `dogfood:agent-image`, opt-in). Because
 `EnsureImage` unconditionally `podman pull`s — "no pre-existence check is done
 by deliberate choice — the pull IS the ensure" (`adapters/image.go:52-65`) —
 and a containers-storage-local image is not pullable, this gap has TWO halves.
@@ -416,17 +416,17 @@ harness does NOT wait for T5's CLI to land (the RPC contracts are on main
 now; the sequencing note is OQ4-adjacent, resolved in-plan: no dependency).
 What leg 2 DOES depend on is a runnable `compass-agent:latest` — RIG-1359's
 runtime activation (artifacts merged: `packages/compass-agent/src/cli.ts`,
-`agent-image/`, `devenv.nix:281` `--image compass-agent:latest`; final
+`agent-image/`, `devenv.nix:296` `--image compass-agent:latest`; final
 activation in progress) — flagged in H2's red case, not an open fork.
 
 ## Alternatives considered
 
 - **Option B — `devenv up` (RIG-1360) + shell-script orchestration (the T7
   shape).** The dogfood loop's own mechanism: `processes.{compass-server,
   compass-runner}` + `services.postgres` with ordered start and a
-  GetServerInfo readiness probe (`devenv.nix:166-290`), the real
+  GetServerInfo readiness probe (`devenv.nix:166-305`), the real
   `compass-agent:latest` image via the opt-in `dogfood:agent-image` task
-  (`devenv.nix:349-354`). Its genuine strength: it IS leg 1's shipped
+  (`devenv.nix:364-369`). Its genuine strength: it IS leg 1's shipped
   bring-up mechanism, and the sibling record's T7 smoke already rides it. It
   loses to C for an AUTOMATED, scenario-bearing harness: orchestration is
   process-compose/shell, a scenario-authoring API with typed assertions over
@@ -869,7 +869,7 @@ D2 (see §Decisions); OQ3/OQ4 remain open.
 2. **OQ4 — Leg-2 activation dependency (RIG-1359).** Leg 2 needs a runnable
    `compass-agent:latest` doing a real (canned or live) turn. The artifacts
    are on main (`packages/compass-agent/src/cli.ts`, `agent-image/`,
-   `devenv.nix:281` runner `--image compass-agent:latest`) but RIG-1359's
+   `devenv.nix:296` runner `--image compass-agent:latest`) but RIG-1359's
    final runtime activation is In Progress. Is the capstone's H2/H3 sequenced
    strictly after RIG-1359 closes, or may H3's deterministic backend land as
    part of the activation itself (one image change instead of two)?