@homeflare/alchemy 0.47.1 → 0.48.1

package/src/talos/cluster-adapter.ts

@@ -0,0 +1,250 @@
+/**
+ * `Kubernetes.ClusterAdapter` kind `talos-openbao`.
+ *
+ * Reads `mount/key` from OpenBao at connect time (`credentials.ts`'s `readKvValue`, which
+ * shells to `bao` with BAO_ADDR/BAO_TOKEN) and returns a `ClusterTransport`.
+ * ⛔ NOTHING IS WRITTEN TO DISK. ⛔ THE PERSISTED CONNECTION IS `{ kind, uid }` ONLY.
+ *   alchemy `Kubernetes/Connection.ts` (v2.0.0-beta.79, lines 12-14) stores the Connection on
+ *   every workload's attributes, so the upstream `client-cert` kind would put the admin PEM in
+ *   the shared state store. The stock `kubeconfig` kind is also refused: an empty path falls
+ *   back to `$KUBECONFIG`.
+ * ⛔ mount/key/context LIVE IN THE ADAPTER'S CONFIGURATION, NOT IN THE AUTH BLOCK. Upstream
+ *   compares clusters by the auth block (`internal/workload.ts:91-96` `connectionIdentity`) and
+ *   HelmChart/Manifest answer `replace` when it changes (`HelmChart.ts:248-258`,
+ *   `Manifest.ts:194-209`); a replace creates first, then cleanup deletes the SAME-named objects.
+ *   Renaming a vault key would silently delete Cilium, External Secrets and Gatekeeper.
+ * ⛔ THE IDENTITY RULE: THE AUTH BLOCK NAMES THE PHYSICAL CLUSTER. `uid` is the kube-system
+ *   Namespace `metadata.uid` (public, stable across CA rotation). read/update/delete all
+ *   reconnect from the SAVED auth block (`Manifest.ts:214` and `:267`, `HelmChart.ts:322` and
+ *   `:335`, via `connectionOfOutput`, `internal/workload.ts:104-108`). A cluster NAME resolved
+ *   through today's MUTABLE config would let a repointed `c1` PATCH one cluster and DELETE on
+ *   another (reproduced through ManifestProvider). So the auth block carries the uid and NOTHING
+ *   else: the config entry is looked up BY uid (no probing walk), `connect` fails closed BEFORE
+ *   any vault read when the uid is absent or the row is legacy (`auth.cluster`), then GETs
+ *   kube-system and compares before returning a transport. Missing, unreadable, unknown or
+ *   different uid is a typed error — never `ClusterNotFoundError` (except a `retired` entry's
+ *   absent key), which upstream turns into a silent no-op. Cost: one extra GET per connect.
+ * ⛔ BOOTSTRAP-THEN-PIN. A brand-new cluster has no uid until it exists, and an Output uid is
+ *   forbidden (`talosOpenBaoConnection`). So: (1) the first deploy creates the cluster and
+ *   `Talos.ClusterIdentity` (which reads and outputs the uid) with NO workloads; (2) the operator
+ *   pins that printed uid literal in this adapter's config; (3) workloads deploy afterwards with
+ *   `talosOpenBaoConnection(<that literal>)`. A uid that is not pinned is refused at connect.
+ * ⚠️ A REAL MOVE IS NOT AN AUTOMATIC REPLACE. `Talos.ClusterIdentity` refuses a changed uid
+ *   (`TalosClusterMoved`); a move is a NEW identity resource per physical cluster, so the old
+ *   rows keep their old uid and their cleanup reaches only the old cluster.
+ * ⛔ ONE 10 s DEADLINE covers the vault read AND the uid GET (`withConnectDeadline`): a hung `bao`
+ *   fails with `TalosOpenBaoConnectTimeout` and the `bao` child is killed. The uid GET has its own
+ *   5 s deadline inside it, so a silent apiserver fails first with `TalosClusterIdentityTimeout`.
+ *   ⚠️ The in-flight HTTPS GET is NOT aborted: upstream `readObject` takes no signal
+ *   (`internal/client.ts:75`), so the socket lives until the OS gives up. Left for the upstream ask.
+ *
+ * USAGE RULES (upstream behaviour this adapter cannot fix; full text in
+ * `docs/talos-openbao-adapter.md`):
+ *   1. Move a workload to another cluster ONLY by new logical IDs (destroy + create), never by
+ *      changing its connection in place.
+ *   2. Manage namespaces as separate `Manifest`s, never HelmChart `createNamespace`.
+ *   3. Never rename a HelmChart `releaseName` in place.
+ *
+ * Walked against alchemy 2.0.0-beta.79 `ClusterAdapter.ts` / `BuiltinAdapters.ts` and the OpenBao
+ * v2.6.2 absence string in `isVaultKeyAbsent`. Fake `bao` and fake apiserver only.
+ */
+import {
+  ClusterAdapter,
+  type ClusterAdapterService,
+  ClusterNotFoundError,
+  type ClusterTransport,
+} from 'alchemy/Kubernetes/ClusterAdapter';
+import type { Connection } from 'alchemy/Kubernetes/Connection';
+import type * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import type * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import {
+  type TalosClusterIdentityMismatch,
+  TalosClusterIdentityMissing,
+  type TalosClusterIdentityTimeout,
+  type TalosClusterIdentityUnreadable,
+  type TalosKubeconfigUnreadable,
+  TalosOpenBaoAmbiguousUid,
+  TalosOpenBaoAuthKind,
+  type TalosOpenBaoConnectTimeout,
+  TalosOpenBaoLegacyAuth,
+  TalosOpenBaoUnknownCluster,
+  TalosUidNotLiteral,
+  type TalosVaultKeyMissing,
+} from './cluster-adapter-errors.ts';
+import { assertClusterUid } from './cluster-identity.ts';
+import {
+  CONNECT_TIMEOUT,
+  type TalosOpenBaoCluster,
+  openTransport,
+  withConnectDeadline,
+} from './cluster-transport.ts';
+
+export {
+  TalosClusterIdentityMismatch,
+  TalosClusterIdentityMissing,
+  TalosClusterIdentityTimeout,
+  TalosClusterIdentityUnreadable,
+  TalosClusterMoved,
+  TalosKubeconfigUnreadable,
+  TalosOpenBaoAmbiguousUid,
+  TalosOpenBaoAuthKind,
+  TalosOpenBaoConnectTimeout,
+  TalosOpenBaoLegacyAuth,
+  TalosOpenBaoUnknownCluster,
+  TalosUidNotLiteral,
+  TalosVaultKeyMissing,
+} from './cluster-adapter-errors.ts';
+export { type TalosOpenBaoCluster, talosOpenBaoCluster } from './cluster-transport.ts';
+
+declare module 'alchemy/Kubernetes/Connection' {
+  interface AuthRegistry {
+    /**
+     * Admin kubeconfig in OpenBao KV, read when a workload connects. Contributed by
+     * {@link TalosOpenBaoAdapter}, which holds the mount, key and context.
+     */
+    'talos-openbao': {
+      /**
+       * The cluster's kube-system `metadata.uid`: the ONLY identity, a LITERAL string known at
+       * plan time (never an Output, see {@link talosOpenBaoConnection}). A row saved before it
+       * existed has none at runtime and is refused at connect.
+       */
+      uid: string;
+    };
+  }
+}
+
+/**
+ * ⛔ KEYED BY ALIAS, BUT THE ALIAS IS NEVER PERSISTED OR LOOKED UP BY. `connect` finds the entry
+ *   whose pinned `uid` equals the saved auth block's, so renaming an alias changes nothing upstream
+ *   hashes. Unknown uid is {@link TalosOpenBaoUnknownCluster}: refused, not another cluster's key.
+ */
+export type TalosOpenBaoConfig = Readonly<Record<string, TalosOpenBaoCluster>>;
+
+/** A `Connection` narrowed to this kind, so a PEM-bearing connection cannot be stored by type. */
+export type TalosOpenBaoConnection = Connection & {
+  readonly auth: { readonly kind: 'talos-openbao'; readonly uid: string };
+};
+
+/**
+ * Serializable connection: kind and uid. No alias, vault path, endpoint, CA or cert.
+ * ⛔ THE UID MUST BE A LITERAL. An Output (a resource attribute such as `Talos.ClusterIdentity`'s)
+ *   is unresolved at plan time, so `isResolved(news)` is false, upstream plans an UPDATE (Plan.ts)
+ *   and reconcile replays the OLD cluster's `previousObjects` as deletes on the NEW cluster
+ *   (reproduced: DELETE on B). Take the uid from the pinned adapter entry: a changed literal is a
+ *   changed auth block, which upstream answers with `replace`. Anything else throws
+ *   {@link TalosUidNotLiteral} while the stack is being declared.
+ */
+export const talosOpenBaoConnection = (uid: string): TalosOpenBaoConnection => {
+  if (typeof uid !== 'string' || uid === '') throw new TalosUidNotLiteral({});
+  return { auth: { kind: 'talos-openbao', uid } };
+};
+
+/**
+ * Resolve one `talos-openbao` connection to a transport. Requires `ChildProcessSpawner`
+ * because the vault read shells to `bao`, and reaches the apiserver once for the identity check.
+ *
+ * ⚠️ A key the vault reports absent is `ClusterNotFoundError` ONLY for a cluster configured
+ *   `retired: true` (upstream `read`/`delete` treat that as "everything in-cluster is already
+ *   gone", so tearing down a destroyed cluster is not stuck). Otherwise it is the typed
+ *   `TalosVaultKeyMissing`. Neither message names document bytes.
+ */
+export const connectTalosOpenBao = (
+  configs: TalosOpenBaoConfig,
+  connection: Connection,
+  timeout: Duration.Duration = CONNECT_TIMEOUT,
+): Effect.Effect<
+  ClusterTransport,
+  | TalosOpenBaoAuthKind
+  | TalosOpenBaoUnknownCluster
+  | TalosOpenBaoAmbiguousUid
+  | TalosOpenBaoLegacyAuth
+  | TalosClusterIdentityMissing
+  | TalosClusterIdentityMismatch
+  | TalosClusterIdentityUnreadable
+  | TalosClusterIdentityTimeout
+  | TalosOpenBaoConnectTimeout
+  | TalosVaultKeyMissing
+  | ClusterNotFoundError
+  | TalosKubeconfigUnreadable
+  | Error,
+  ChildProcessSpawner.ChildProcessSpawner
+> =>
+  Effect.gen(function* () {
+    // ⛔ FAIL CLOSED BEFORE ANY DESTRUCTURING: a saved row missing its whole connection, or just
+    //   its auth block, names no physical cluster — a typed refusal, never a raw TypeError.
+    if (connection === undefined || connection === null) {
+      return yield* Effect.fail(new TalosClusterIdentityMissing({}));
+    }
+    const { auth } = connection;
+    if (auth === undefined || auth === null) {
+      return yield* Effect.fail(new TalosClusterIdentityMissing({}));
+    }
+    if (auth.kind !== 'talos-openbao') {
+      return yield* Effect.fail(new TalosOpenBaoAuthKind({ kind: auth.kind }));
+    }
+    // ⛔ Before the vault is touched. A row saved with an alias is refused even if it also has a
+    //   uid: no silent migration, the saved state is edited deliberately (the error says how).
+    if (Object.hasOwn(auth, 'cluster')) {
+      return yield* Effect.fail(new TalosOpenBaoLegacyAuth({}));
+    }
+    const { uid } = auth;
+    if (typeof uid !== 'string' || uid === '') {
+      return yield* Effect.fail(new TalosClusterIdentityMissing({}));
+    }
+    const matches = Object.entries(configs).filter(([, entry]) => entry.uid === uid);
+    const [match] = matches;
+    if (match === undefined) {
+      return yield* Effect.fail(
+        new TalosOpenBaoUnknownCluster({
+          known: Object.values(configs).map((entry) => entry.uid),
+          uid,
+        }),
+      );
+    }
+    // ⛔ Two entries claiming one uid is a configuration error: refuse, never pick one.
+    if (matches.length > 1) {
+      return yield* Effect.fail(
+        new TalosOpenBaoAmbiguousUid({ aliases: matches.map(([alias]) => alias), uid }),
+      );
+    }
+    const [alias, config] = match;
+    // ⛔ A retired pin means the cluster is gone: no vault read, so destroying its rows completes.
+    if (config.retired === true) {
+      return yield* Effect.fail(
+        new ClusterNotFoundError({ message: `talos-openbao cluster '${alias}' is retired` }),
+      );
+    }
+    // ⛔ One deadline over the vault read AND the uid GET (`withConnectDeadline`).
+    return yield* withConnectDeadline(
+      alias,
+      Effect.gen(function* () {
+        const transport = yield* openTransport(config);
+        yield* assertClusterUid(alias, uid, transport);
+        return transport;
+      }),
+      timeout,
+    );
+  });
+
+/**
+ * Register kind `talos-openbao`. Merge with `Kubernetes.providers()`:
+ * `Layer.mergeAll(Kubernetes.providers(), TalosOpenBaoAdapter({ c1: talosOpenBaoCluster(kc1) }))`
+ * where `kc1` is the props object handed to `Talos.Kubeconfig`.
+ */
+export const TalosOpenBaoAdapter = (
+  config: TalosOpenBaoConfig,
+): Layer.Layer<ClusterAdapterService, never, ChildProcessSpawner.ChildProcessSpawner> =>
+  Layer.effect(
+    ClusterAdapter('talos-openbao'),
+    Effect.gen(function* () {
+      const context = yield* Effect.context<ChildProcessSpawner.ChildProcessSpawner>();
+      const service: ClusterAdapterService = {
+        kind: 'Kubernetes.ClusterAdapter',
+        connect: (connection) =>
+          connectTalosOpenBao(config, connection).pipe(Effect.provideContext(context)),
+      };
+      return service;
+    }),
+  );

package/src/talos/cluster-identity.ts

@@ -0,0 +1,63 @@
+/**
+ * Which PHYSICAL cluster answers — the kube-system Namespace's `metadata.uid`.
+ *
+ * ★ WHY THE UID. It is public, assigned once at cluster creation and stable across CA and
+ *   admin-cert rotation (a CA fingerprint is not: rotation would read as "a different cluster").
+ *   Every cluster has the namespace, and the admin kubeconfig can read it.
+ * ★ The GET goes through alchemy's own `readObject` (`Kubernetes/internal/client.ts`, reached
+ *   through the package's `./*` export) so TLS, CA and client-cert handling stay upstream's.
+ */
+import type { ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+import { readObject } from 'alchemy/Kubernetes/internal/client';
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import {
+  TalosClusterIdentityMismatch,
+  TalosClusterIdentityTimeout,
+  TalosClusterIdentityUnreadable,
+} from './cluster-adapter-errors.ts';
+
+const KUBE_SYSTEM = { apiVersion: 'v1', kind: 'Namespace', name: 'kube-system' } as const;
+
+/**
+ * ⛔ upstream `readObject` (`internal/client.ts`) sets no request timeout, so a silent apiserver
+ *   would hang connect and every plan. Bounded here; the failure is typed and closed.
+ * ⛔ SHORTER THAN `CONNECT_TIMEOUT` (10 s, cluster-transport.ts): the outer deadline wraps the vault
+ *   read AND this uid GET together, so an equal inner deadline could never fire first and
+ *   `TalosClusterIdentityTimeout` was unreachable through `connectTalosOpenBao` (red team, PR 355).
+ *   A silent apiserver now fails with the identity timeout while a slow `bao` still gets the full
+ *   outer budget.
+ */
+export const UID_READ_TIMEOUT = Duration.seconds(5);
+
+/** The cluster's kube-system uid. Request failures propagate: nothing here fails open. */
+export const readClusterUid = (
+  cluster: string,
+  transport: ClusterTransport,
+  timeout: Duration.Duration = UID_READ_TIMEOUT,
+) =>
+  readObject({ object: KUBE_SYSTEM, transport }).pipe(
+    Effect.timeoutOrElse({
+      duration: timeout,
+      orElse: () =>
+        Effect.fail(
+          new TalosClusterIdentityTimeout({ cluster, seconds: Duration.toSeconds(timeout) }),
+        ),
+    }),
+    Effect.flatMap((body) => {
+      const uid = (body as { metadata?: { uid?: unknown } } | undefined)?.metadata?.uid;
+      return typeof uid === 'string' && uid !== ''
+        ? Effect.succeed(uid)
+        : Effect.fail(new TalosClusterIdentityUnreadable({ cluster }));
+    }),
+  );
+
+/** Succeeds only when the answering cluster is the one `expected` names. */
+export const assertClusterUid = (cluster: string, expected: string, transport: ClusterTransport) =>
+  readClusterUid(cluster, transport).pipe(
+    Effect.flatMap((got) =>
+      got === expected
+        ? Effect.void
+        : Effect.fail(new TalosClusterIdentityMismatch({ cluster, expected, got })),
+    ),
+  );

package/src/talos/cluster-transport.ts

@@ -0,0 +1,110 @@
+/**
+ * One cluster's vault location and the in-memory read of its admin kubeconfig, shared by the
+ * `talos-openbao` adapter (which then verifies identity) and `Talos.ClusterIdentity` (which
+ * reads the uid the adapter will later demand).
+ */
+import type { ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import {
+  TalosKubeconfigUnreadable,
+  TalosOpenBaoConnectTimeout,
+  TalosVaultKeyMissing,
+} from './cluster-adapter-errors.ts';
+import { DEFAULT_KUBECONFIG_KEY, isVaultKeyAbsent, readKvValue } from './credentials.ts';
+import { kubeconfigTransport } from './kubeconfig-doc.ts';
+import type { KubeconfigProps } from './kubeconfig.ts';
+
+/** Where one cluster's admin kubeconfig lives in the vault. Configuration; never persisted. */
+export type TalosVaultLocation = {
+  /** OpenBao KV mount, e.g. `talos-c1`. */
+  readonly mount: string;
+  /** Path under the mount. `Talos.Kubeconfig` writes `kubeconfig` unless `kubeconfigKey` is set. */
+  readonly key: string;
+  /** Context name inside the kubeconfig. Not secret. */
+  readonly context: string;
+};
+
+/**
+ * One adapter entry: a vault location PINNED to the physical cluster it must answer as.
+ * ⛔ `uid` is the kube-system `metadata.uid`. The persisted auth block carries only this, and
+ *   connect looks the entry up BY it, so renaming the alias, vault key, mount or context changes
+ *   nothing upstream hashes (`internal/workload.ts:91-96` `connectionIdentity`). Connect still
+ *   proves the answering cluster has this uid before it returns a transport.
+ */
+export type TalosOpenBaoCluster = TalosVaultLocation & {
+  readonly uid: string;
+  /**
+   * ⛔ ONLY `true` MAKES THIS UID MEAN "THE CLUSTER IS GONE": connect answers `ClusterNotFoundError`
+   *   (upstream read/delete treat it as "everything in-cluster is already gone") WITHOUT a vault
+   *   read, so destroying a dead cluster's rows completes. Otherwise an absent key is the loud
+   *   `TalosVaultKeyMissing`: a typo in mount/key must not make `destroy` a silent no-op.
+   */
+  readonly retired?: boolean;
+};
+
+/**
+ * ★ ONE SOURCE OF TRUTH FOR mount/key/context: build the location from the SAME props the
+ *   `Talos.Kubeconfig` resource writes with (`target.mount`, `kubeconfigKey`, `context`), so the
+ *   writer and the reader cannot disagree.
+ */
+export const talosVaultLocation = (
+  props: Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>,
+): TalosVaultLocation => ({
+  context: props.context,
+  key: props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY,
+  mount: props.target.mount,
+});
+
+/** An adapter entry: {@link talosVaultLocation} plus the uid it is pinned to. */
+export const talosOpenBaoCluster = (
+  props: Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>,
+  pin: { readonly uid: string; readonly retired?: boolean },
+): TalosOpenBaoCluster => ({
+  ...talosVaultLocation(props),
+  uid: pin.uid,
+  ...(pin.retired === true ? { retired: true } : {}),
+});
+
+/**
+ * ⛔ ONE DEADLINE FOR THE WHOLE CONNECT PATH. `bao kv get` has no timeout of its own, and the
+ *   uid GET's bound (`cluster-identity.ts`) only starts after the vault read returns, so a hung
+ *   `bao` hung connect and every plan. Interrupting the effect closes the spawn scope, which
+ *   signals the child's process group (`NodeChildProcessSpawner` `terminateProcessGroup`).
+ */
+export const CONNECT_TIMEOUT = Duration.seconds(10);
+
+export const withConnectDeadline = <A, E, R>(
+  cluster: string,
+  effect: Effect.Effect<A, E, R>,
+  timeout: Duration.Duration = CONNECT_TIMEOUT,
+) =>
+  effect.pipe(
+    Effect.timeoutOrElse({
+      duration: timeout,
+      orElse: () =>
+        Effect.fail(
+          new TalosOpenBaoConnectTimeout({ cluster, seconds: Duration.toSeconds(timeout) }),
+        ),
+    }),
+  );
+
+/**
+ * Vault read and parse, in memory. ⛔ No identity check here: callers decide what to trust.
+ * ⚠️ Only a document that does not parse is `TalosKubeconfigUnreadable`; a parser or runtime
+ *   failure (a missing global, a broken import) is a defect and propagates as one.
+ */
+export const openTransport = (config: TalosVaultLocation) =>
+  Effect.gen(function* () {
+    const { context, key, mount } = config;
+    const raw = yield* readKvValue(mount, key, ['kubeconfig', 'config']).pipe(
+      Effect.mapError((error) =>
+        isVaultKeyAbsent(error) ? new TalosVaultKeyMissing({ key, mount }) : error,
+      ),
+    );
+    const material = yield* Effect.sync(() => kubeconfigTransport(raw, context));
+    if (material === undefined) {
+      return yield* Effect.fail(new TalosKubeconfigUnreadable({ context, key, mount }));
+    }
+    return { ...material, headers: Effect.succeed({}) } satisfies ClusterTransport;
+  });

package/src/talos/credentials-write.ts

@@ -13,9 +13,16 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as Scope from 'effect/Scope';
+import * as Duration from 'effect/Duration';
 import * as Stream from 'effect/Stream';
+import { unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import * as ChildProcess from 'effect/process/ChildProcess';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { baoEnv } from './bao-env.ts';
+import { resolveBao } from './talosctl-binary.ts';
 
 /**
  * A fresh, unguessable temp path for SOME OTHER PROCESS (talosctl) to create — unlike
@@ -29,9 +36,9 @@ export const reservedTempPath = (
   label: string,
 ): Effect.Effect<{ readonly path: string }, never, Scope.Scope> =>
   Effect.gen(function* () {
-    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
+    const path = join(tmpdir(), `hf-talos-${label}-${randomUUID()}.yaml`);
     yield* Effect.addFinalizer(() =>
-      Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(
+      Effect.tryPromise({ try: () => unlink(path), catch: () => undefined }).pipe(
         Effect.orElseSucceed(() => undefined),
       ),
     );
@@ -63,9 +70,24 @@ export const writeKvValue = (
 ): Effect.Effect<void, Error, ChildProcessSpawner.ChildProcessSpawner> =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    const result = yield* ChildProcess.make('bao', ['kv', 'put', `${mount}/${key}`, `${field}=-`], {
-      detached: false,
-      extendEnv: true,
+    // ⛔ Same vetting as `readKvValue`: `bao` writes credentials, so it is resolved and vetted before
+    //   any env is built or passed — a fake `bao` in a writable PATH folder is refused, never launched.
+    const bao = yield* resolveBao();
+    const env = baoEnv();
+    if (env === undefined) {
+      return yield* Effect.fail(
+        new Error(
+          `bao kv put ${mount}/${key} refused: BAO_ADDR and BAO_TOKEN must both be set. ` +
+            "Without them bao would fall back to a cached login in the operator's home.",
+        ),
+      );
+    }
+    const result = yield* ChildProcess.make(bao, ['kv', 'put', `${mount}/${key}`, `${field}=-`], {
+      env,
+      extendEnv: false,
+      // ⛔ Mirror readKvValue's spawn: `bao` leads its own process group (killed whole on interrupt)
+      //   and a SIGTERM-ignoring `bao` is SIGKILLed 1 s later instead of blocking the plan.
+      forceKillAfter: Duration.seconds(1),
       stderr: 'pipe',
       stdin: Stream.fromIterable([new TextEncoder().encode(value)]),
       stdout: 'pipe',

package/src/talos/credentials.ts

@@ -30,12 +30,17 @@
  *   assigns, and `bao kv get` inserts the KV-v2 `data/` API segment itself — a key already
  *   prefixed `data/` reads `<mount>/data/data/<key>`, which the OLD default did.
  */
-import { closeSync, openSync, writeFileSync } from 'node:fs';
+import * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import type * as Scope from 'effect/Scope';
 import * as Stream from 'effect/Stream';
 import * as ChildProcess from 'effect/process/ChildProcess';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { baoEnv } from './bao-env.ts';
+import { resolveBao } from './talosctl-binary.ts';
+import { mintKvTempFile } from './mint-temp-file.ts';
+
+export { mintKvTempFile } from './mint-temp-file.ts';
 
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
@@ -81,10 +86,34 @@ export const readKvValue = (
 ): Effect.Effect<string, Error, ChildProcessSpawner.ChildProcessSpawner> =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    // ⛔ `bao` fetches the cluster credentials, so it is resolved and VETTED before any env is built
+    //   or passed: a fake `bao` in a group/world-writable PATH folder is refused here, never launched.
+    const bao = yield* resolveBao();
+    const env = baoEnv();
+    if (env === undefined) {
+      return yield* Effect.fail(
+        new Error(
+          `bao kv get ${mount}/${key} refused: BAO_ADDR and BAO_TOKEN must both be set. ` +
+            "Without them bao would fall back to a cached login in the operator's home.",
+        ),
+      );
+    }
     const result = yield* ChildProcess.make(
-      'bao',
+      bao,
       ['kv', 'get', '-format=json', `${mount}/${key}`],
-      { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },
+      // ⛔ NO `detached: false`, AND `forceKillAfter` IS SET (round-4 review). Effect detaches on
+      //   Unix so `bao` leads its own process group, and the scope finalizer signals the WHOLE group
+      //   (`NodeChildProcessSpawner`: `kill(-pid)`). With `detached: false` a `bao` that forked a
+      //   sleeper left the grandchild alive, and without `forceKillAfter` a `bao` that ignores
+      //   SIGTERM kept connect blocked past its deadline. 1 s after SIGTERM the group gets SIGKILL.
+      {
+        env,
+        extendEnv: false,
+        forceKillAfter: Duration.seconds(1),
+        stderr: 'pipe',
+        stdin: 'ignore',
+        stdout: 'pipe',
+      },
     ).pipe(
       spawner.spawn,
       Effect.flatMap((child) =>
@@ -114,7 +143,15 @@ export const readKvValue = (
       );
     }
 
-    const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };
+    // ⛔ A V8 SyntaxError quotes the offending input; this stdout may hold the secret itself.
+    let parsed: { data?: { data?: Record<string, unknown> } };
+    try {
+      parsed = JSON.parse(result.stdout) as typeof parsed;
+    } catch {
+      return yield* Effect.fail(
+        new Error(`bao kv get ${mount}/${key} returned output that is not JSON (not echoed).`),
+      );
+    }
     const data = parsed.data?.data;
     for (const field of fields) {
       const raw = data?.[field];
@@ -129,44 +166,13 @@ export const readKvValue = (
   });
 
 /**
- * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's
- * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of this file.
- *
- * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster
- *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so
- *   it lands at the process umask — world-readable on this estate — for as long as the resource
- *   runs. The name is unguessable, and "unguessable" is not a permission.
- * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an
- *   attacker pre-created (the classic /tmp symlink race), and with a UUIDv7 name a collision is a
- *   genuine error rather than something to paper over.
- * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is
- *   what makes that survivable rather than a disclosure.
+ * ★ MEASURED AGAINST OPENBAO v2.6.2 (C1 fix, LAND red team, 2026-09-26 — isolated in-memory
+ *   dev server): `bao kv get` on an unwritten KV-v2 key exits 2 with stderr exactly
+ *   `No value found at <mount>/data/<key>`. `readKvValue`'s Error embeds that text. It is the
+ *   only signal treated as "not written yet"; a permission denial or a transport failure is not.
  */
-export const mintKvTempFile = (
-  raw: string,
-  label: string,
-): Effect.Effect<{ readonly path: string }, Error, Scope.Scope> =>
-  Effect.gen(function* () {
-    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
-    yield* Effect.acquireRelease(
-      Effect.try({
-        try: () => {
-          const fd = openSync(path, 'wx', 0o600);
-          try {
-            writeFileSync(fd, raw);
-          } finally {
-            closeSync(fd);
-          }
-        },
-        catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`),
-      }),
-      () =>
-        Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(
-          Effect.orElseSucceed(() => undefined),
-        ),
-    );
-    return { path };
-  });
+export const isVaultKeyAbsent = (error: unknown): boolean =>
+  error instanceof Error && /no value found at/i.test(error.message);
 
 /**
  * Mint one talosconfig file for `target`.
@@ -188,10 +194,10 @@ export const mintTalosconfig = (
 
 /**
  * Mint one temp kubeconfig file from the vault copy `Talos.Kubeconfig` writes at bring-up
- * (K-talos-first-boot, 2026-09-26) — the consumer-side counterpart to {@link mintTalosconfig},
- * named as the future seam for `Kubernetes.ClusterAdapter` in
- * docs/plans/2026-09-26-talos-secrets-flow.md ("consumers mint it the way the talosconfig is
- * minted"). Not yet wired to that adapter — this only makes the read+materialize step exist.
+ * (K-talos-first-boot, 2026-09-26) — the file-shaped counterpart to {@link mintTalosconfig}.
+ * `Kubernetes.ClusterAdapter` `talos-openbao` does not use it: connect reads the bytes with
+ * {@link readKvValue} and keeps them in memory. This remains for a caller that must hand a
+ * path to a process.
  */
 export const mintKubeconfig = (
   target: TalosTarget,