Repository navigation
8000
T29 — Keychain secrets by reference, end to end #2294
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Keychain secrets by reference | M | needs care | standard | an agent | 200 (80 code, 120 tests) |
Store an API key with
min secret, reference it in a box spec, and the box's requests to its upstream carry it while the key never enters the box.
Covers:
- none
Layers:
- e2e:
- scripts/session-e2e.sh: one case: set a secret, add a rule, reference it in a box spec, see the upstream receive it, and find it nowhere in the box
./scripts/session-e2e.sh bep_store_reference_end_to_end
Waits on:
- T25 — Read client-owned store rules and refuse rules in the deny set #2280
- T26 — Store, list and remove secrets with min secret under proxy-only access #2287
- T27 — Mint store handles and keep the client's key registered across proxy restarts #2288
- T28 — Inject a stored key in the registered form, read from the Keychain per request #2292
- T39 — Write the store rule from min secret set, with fixed-token presets #2325
Plan block
### T29 — Keychain secrets by reference, end to end
slice: S3
kind: integration
covers: none
size: M
est: 80 code, 120 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: `min box audit <box>` shows each injection of the run by store and identifier
observability: one connection span per injected request, with the store and identifier, never the value
layers:
- e2e:
- scripts/session-e2e.sh: one case: set a secret, add a rule, reference it in a box spec, see the upstream receive it, and find it nowhere in the box
test: ./scripts/session-e2e.sh bep_store_reference_end_to_end
produces: none
consumes: none
proof: Store an API key with `min secret`, reference it in a box spec, and the box's requests to its upstream carry it while the key never enters the box.
depends on:
- blocked by #2280
- blocked by #2287
- blocked by #2288
- blocked by #2292
- blocked by #2325
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 26, 2026
Done. #2612 merged.
branch
agent/2294-keychain-secrets-by-reference-end-to-end· epic #1501 · PR #261214d181220d154b43c2998a740fcacff342f9c91f4174beded684080cd7360883ea39bdf0a3f87f6e7f5d911c3a13d50a0e07df7d5af77a4f4fc49800917e3c111c6b4d48Updated 2026-10-30T23:13:46.833Z.