Secret-storage practice: per-host 0600 store, agent read guard hook + deny rules, managed-profile install, names-only checker

[seathatflowsinourveins]

Adds one secret-storage practice for every host. Secret values never reach git or GitHub, agents are blocked from reading them, and future sessions and new PCs can pick them up without extra steps.

Store.

• Each provider gets its own plaintext file of mode 0600, owned by the user, outside every Git worktree, in one directory per host: ${XDG_CONFIG_HOME:-$HOME/.config}/native-agent-stack/ (mode 0700). For example alpaca-paper.env and sec-contact.env. It is loaded by explicit path (--env-file, or set -a; . file; set +a inside the command).
• The files are never exported from shell startup files, because exported values leak through /proc/<pid>/environ and child processes.
• Native sign-ins (Claude, Codex, gh, IB Gateway) stay in each tool's own store.
• This keeps the enforced 2026-09-22 broker rule (runner.credentials) and extends it.

Agent guardrails. Deny rules alone do not stop Bash cat, so they are paired with a hook.

• scripts/hooks/secret_path_guard.py is a deterministic PreToolUse hook. It blocks:
  • readers and searches that touch the store, *.env files, pointer variables or listed secret names;
  • shell tracing combined with sourcing;
  • environment dumps after sourcing;
  • /proc/*/environ;
  • the gh token and git credential fill routes.
• Tests: 80 blocked cases, plus a 66-command safe corpus.
• The project .claude/settings.json adds permissions.deny rules.
• The managed user profile (install_claude_profile.py --only guard plus claude.settings.template.json) installs the same hook and rules on every new PC. Both hooks are pinned by SHA-256 and checked before copying.
• Codex: the docs recommend [shell_environment_policy] inherit = "none", which is the setting the repo measured, and state plainly that this controls environment inheritance, not file reads.

GitHub and git.

• Secret scanning and push protection were already enabled on this public repo. Non-provider patterns and validity checks need paid Secret Protection on a personal repo.
• scripts/git-hooks/pre-commit runs gitleaks, in addition to the gitleaks job in CI.
• .gitignore gains more patterns.

Inventory and checker.

• adoption/credential-inventory.json lists names, classes, lanes, statuses, store paths and loaders, and no values.
• scripts/credential_status.py uses lstat and variable names only, and never opens a value into its output (tests use fake values). With --client-guards it reports booleans only, including whether Claude telemetry logs content.
• Measured on this host: every content flag is false.
• Docs: docs/secret-storage.md and docs/decisions/2026-09-24-secret-storage.md. The decision record lists the alternatives rejected: systemd-creds, sops/age, pass, keyring, the 1Password and Bitwarden CLIs, and exported environment variables.

Credential status (from the inventory):

Status	Credentials
Required now	Alpaca paper key pair; SEC contact identity
Paid, user-only	Databento, Typesafe
Optional	OmniRoute
Native sign-ins	Claude, Codex, gh, IB Gateway
Mention only	~15 names that appear only in catalogs or third-party docs

Verification

• CI-style runs (with PyYAML and jsonschema) of the guard, checker, installer, apply-settings and pre-commit tests all pass. Skips are host-copy tests only.
• validate.py, validate_catalogs.py, landscape.py, evidence_manifest.py --check and verdict_review_gate ("no verdict rows changed") all pass.
• credential_status.py on this host: both required stores are ok (0600 in a 0700 directory), no broker variable is set in the environment, and no sensitive file is tracked.
• The one host-only failure, test_effort_default_guard.test_shipped_guard_is_verbatim, comes from a stale host copy of that hook.

Review. The design was adversarially refuted twice before the build: the deny rules alone did not stop Bash cat, and Codex has no per-path read deny. Two independent review rounds followed, with every medium finding fixed in 9c4a2d5 and 0936894.

Host step after merge:

install_claude_profile.py --only guard
render_config.py
apply_claude_settings.py --dry-run
apply_claude_settings.py
git config core.hooksPath scripts/git-hooks
credential_status.py --client-guards

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.