Skip to main content
Supersedes 0009. The rest of 0009 carries forward (see decision 6). The always-on rule secrets.md is rewritten in the same change, because it still says “no sync”.

​
Context

0009 (Accepted) kept production secrets in the runtime’s store, set by a human, with no sync from Infisical. The owner overrode that on 2026-10-20 (DP19 option b): Infisical is the source, and runway syncs it into Encore, Cloudflare Workers and EAS on deploy (mem L448). The always-on rule still told agents that sync was not adopted, so the rule was wrong for every session until this change.

​
Decision

  1. Source (DP19 b). Infisical is the source of production secrets. Runway syncs them into Encore, Cloudflare Workers and EAS on deploy.
  2. Key homes. The three key homes of 0107 stand.
  3. Secret references. The secret('Name') references of 0146 stand. Gen declares them as Encore secrets.
  4. Developer machines (DC4). Dev boxes use an instance role, an Infisical machine identity and Agent Vault. Nothing is stored on disk.
  5. CI. CI reads Infisical through OIDC (ADR 0167, CI12).
  6. Carried forward from 0009. Secret names are in git and values are not. There is no .env file. The forbidden commands stay forbidden. Verify needs zero secrets.
  7. Secret-manager agent (owner 2026-10-20 night; amends the “values are set by a human” invariant of 0009 and 0173). A dedicated secret-manager agent may write secret values into Infisical for every environment without reading them. One audited script, pnpm secrets:import, streams a file from a single inbox folder outside the repositories into Infisical with output suppressed, verifies the write by hash, deletes the source file and logs only the names. Hooks allow that script for that agent alone. A production write is prepared with a dry run, and it is fired only after the owner answers yes. Runtime-store secrets for Encore follow the same flow once a tool exists.

​
Consequences

  • A rotation in Infisical reaches every target on the next deploy, so there is one rotation point.
  • The always-on rule secrets.md changes with this ADR: “Infisical Secret Sync is not adopted” is replaced by decision 1.

​
Enforcement

planned — the runway sync step is checked by the deploy job; guard-bash keeps the deploy sync command on its allow-list (.agents/hooks/guard-bash.mjs). The gitleaks pre-commit and CI scan (ADR 0009) carry forward.

​
Alternatives

  • Set production secrets by hand in each runtime store: superseded by DP19; it cannot be audited.
  • Infisical Secret Sync not adopted (0009 D8): superseded by DP19.

​
Supersedes and sources

Supersedes: 0009. Sources: owner override DP19 b (stackra-decisions-2026-10-19.md L448, 2026-10-20); DC4 (L496); CI12 (ADR 0167). Closes gaps B24, B52 and part of C52. Gap analysis B-15 (the rule that contradicted this) is closed by the rule rewrite in this change.