Repository navigation
T26 — Store, list and remove secrets with min secret under proxy-only access #2287
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Keychain secrets by reference | L | needs care | strongest | an agent | 860 (380 code, 480 tests) |
min secret set claudeprints only the identifier, andmin secret listshows its metadata and no value.
Covers:
- BEP-050
- BEP-051
- BEP-052
- BEP-053
Layers:
- cli:
- crates/minimal/src/cli.rs:
min secret set | list | rm [--store <s>] - crates/minimal/src/cmd/mod.rs: dispatch and module line
- crates/minimal/src/cmd/secret.rs (new):
set,list,rmper BEP-050, BEP-052 and BEP-053 cargo nextest run -p minimal secret_set_stores_in_keychain_and_prints_id_onlycargo nextest run -p minimal secret_set_refuses_value_argument_and_env_flagcargo nextest run -p minimal secret_set_without_tty_or_stdin_fails_immediatelycargo nextest run -p minimal secret_set_refuses_gatehouse_storecargo nextest run -p minimal secret_list_shows_metadata_without_valuescargo nextest run -p minimal secret_rm_removes_item
- crates/minimal/src/cli.rs:
- store:
- crates/bep/src/store.rs (new): Keychain store items with the BEP-051 access control
- crates/bep/src/lib.rs: module line
cargo nextest run -p minimal secret_item_acl_admits_proxy_onlycargo nextest run -p minimal secret_set_refuses_when_proxy_binary_absent
Waits on:
Plan block
### T26 — Store, list and remove secrets with min secret under proxy-only access
slice: S3
kind: task
covers: BEP-050, BEP-051, BEP-052, BEP-053
size: L
est: 380 code, 480 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min secret set <id> <value>` is refused with "min secret set reads the value from the terminal or standard input, never from an argument or an environment flag." on stderr, pinned by secret_set_refuses_value_argument_and_env_flag; `min secret list` shows store, authorities, injection form, consent rule and whether the proxy's access entry is present, never a value
observability: one info log line per set and remove naming the store and the identifier, never the value
layers:
- cli:
- crates/minimal/src/cli.rs: `min secret set | list | rm [--store <s>]`
- crates/minimal/src/cmd/mod.rs: dispatch and module line
- crates/minimal/src/cmd/secret.rs (new): `set`, `list`, `rm` per BEP-050, BEP-052 and BEP-053
test: cargo nextest run -p minimal secret_set_stores_in_keychain_and_prints_id_only
test: cargo nextest run -p minimal secret_set_refuses_value_argument_and_env_flag
test: cargo nextest run -p minimal secret_set_without_tty_or_stdin_fails_immediately
test: cargo nextest run -p minimal secret_set_refuses_gatehouse_store
test: cargo nextest run -p minimal secret_list_shows_metadata_without_values
test: cargo nextest run -p minimal secret_rm_removes_item
- store:
- crates/bep/src/store.rs (new): Keychain store items with the BEP-051 access control
- crates/bep/src/lib.rs: module line
test: cargo nextest run -p minimal secret_item_acl_admits_proxy_only
test: cargo nextest run -p minimal secret_set_refuses_when_proxy_binary_absent
produces:
- crates/bep/src/store.rs
consumes: none
proof: `min secret set claude` prints only the identifier, and `min secret list` shows its metadata and no value.
depends on:
- blocked by #2280
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 24, 2026
Done. #2522 merged.
branch
agent/2287-store-list-and-remove-secrets-with-min-secret-un· epic #1501 · PR #252236700608077e0604ee6d353236a735a709c12ce8110866470b7d047bc193cd8d7d4f84b5Updated 2026-10-25T17:35:24.861Z.