> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackra.figentra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 0173 — Secrets: Infisical is the source of production secrets, and runway syncs them

> Accepted, amended by 0267 · 2026-10-20

> [!NOTE]
>
> Supersedes [0009](/adr/0009-secrets-two-mechanisms). The rest of 0009 carries forward (see
> decision 6). The always-on rule `secrets.md` is rewritten in the same change, because it still
> says "no sync".

> [!NOTE]
>
> Amended by [0267](/adr/0267-infisical-agent-vault-deferred): Developer machines do not use Agent
> Vault (decision 2 of 0267). They use the `/agents` vault paths in force.

## Context

[0009](/adr/0009-secrets-two-mechanisms) (Accepted) kept production secrets in the runtime's store, set by a human, with no sync from Infisical. The owner
overrode that on 2026-10-20 (DP19 option b): Infisical is the source, and runway syncs it into Encore, Cloudflare Workers and EAS on deploy (mem L448).
The always-on rule still told agents that sync was not adopted, so the rule was wrong for every session until this change.

## Decision

1. **Source (DP19 b).** Infisical is the source of production secrets. Runway syncs them into Encore, Cloudflare Workers and EAS on deploy.
2. **Key homes.** The three key homes of [0107](/adr/0107-connections-store-and-three-key-homes) stand.
3. **Secret references.** The `secret('Name')` references of [0146](/adr/0146-package-configuration-typescript-layers-and-secret-references) stand. Gen declares them as Encore secrets.
4. **Developer machines (DC4).** Dev boxes use an instance role, an Infisical machine identity and Agent Vault. Nothing is stored on disk.
5. **CI.** CI reads Infisical through OIDC (ADR 0167, CI12).
6. **Carried forward from 0009.** Secret names are in git and values are not. There is no `.env` file. The forbidden commands stay forbidden. Verify needs zero secrets.
7. **Secret-manager agent (owner 2026-10-20 night; amends the "values are set by a human" invariant of 0009 and 0173).** A dedicated `secret-manager` agent may write secret values into Infisical for every environment without reading them. One audited script, `pnpm secrets:import`, streams a file from a single inbox folder outside the repositories into Infisical with output suppressed, verifies the write by hash, deletes the source file and logs only the names. Hooks allow that script for that agent alone. A production write is prepared with a dry run, and it is fired only after the owner answers yes. Runtime-store secrets for Encore follow the same flow once a tool exists.

## Consequences

* A rotation in Infisical reaches every target on the next deploy, so there is one rotation point.
* The always-on rule `secrets.md` changes with this ADR: "Infisical Secret Sync is not adopted" is replaced by decision 1.

## Enforcement

planned — the runway sync step is checked by the deploy job; `guard-bash` keeps the deploy sync command on its allow-list (`.agents/hooks/guard-bash.mjs`). The gitleaks
pre-commit and CI scan (ADR 0009) carry forward.

## Alternatives

* Set production secrets by hand in each runtime store: superseded by DP19; it cannot be audited.
* Infisical Secret Sync not adopted (0009 D8): superseded by DP19.

## Supersedes and sources

Supersedes: [0009](/adr/0009-secrets-two-mechanisms). Sources: owner override DP19 b (`stackra-decisions-2026-10-19.md` L448, 2026-10-20); DC4 (L496); CI12 (ADR 0167).
Closes gaps B24, B52 and part of C52. Gap analysis B-15 (the rule that contradicted this) is closed by the rule rewrite in this change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.