rcf-lite 0.26.0 → 0.28.0

package/blueprints/security-secrets-management/blueprint.json

@@ -1,34 +1,136 @@
 {
   "slug": "security-secrets-management",
-  "version": "1.0.1",
+  "version": "1.1.5",
   "category": "security",
-  "capabilities": ["secretsProvider"],
+  "capabilities": [
+    "secretsProvider"
+  ],
   "contributions": [
-    { "id": "security-secrets-management-REQ-001", "kind": "req", "path": "requirements/security-secrets-management-req-001.json" },
-    { "id": "security-secrets-management-REQ-002", "kind": "req", "path": "requirements/security-secrets-management-req-002.json" },
-    { "id": "security-secrets-management-REQ-003", "kind": "req", "path": "requirements/security-secrets-management-req-003.json" },
-    { "id": "security-secrets-management-REQ-004", "kind": "req", "path": "requirements/security-secrets-management-req-004.json" },
-    { "id": "security-secrets-management-REQ-005", "kind": "req", "path": "requirements/security-secrets-management-req-005.json" },
-    { "id": "security-secrets-management-REQ-006", "kind": "req", "path": "requirements/security-secrets-management-req-006.json" },
-    { "id": "security-secrets-management-REQ-007", "kind": "req", "path": "requirements/security-secrets-management-req-007.json" },
-    { "id": "security-secrets-management-REQ-008", "kind": "req", "path": "requirements/security-secrets-management-req-008.json" },
-    { "id": "security-secrets-management-REQ-009", "kind": "req", "path": "requirements/security-secrets-management-req-009.json" },
-    { "id": "security-secrets-management-REQ-010", "kind": "req", "path": "requirements/security-secrets-management-req-010.json" },
-    { "id": "security-secrets-management-US-8101", "kind": "us", "path": "user-stories/security-secrets-management-us-8101.json" },
-    { "id": "security-secrets-management-US-8102", "kind": "us", "path": "user-stories/security-secrets-management-us-8102.json" },
-    { "id": "security-secrets-management-US-8103", "kind": "us", "path": "user-stories/security-secrets-management-us-8103.json" },
-    { "id": "security-secrets-management-US-8104", "kind": "us", "path": "user-stories/security-secrets-management-us-8104.json" },
-    { "id": "security-secrets-management-US-8105", "kind": "us", "path": "user-stories/security-secrets-management-us-8105.json" },
-    { "id": "security-secrets-management-US-8106", "kind": "us", "path": "user-stories/security-secrets-management-us-8106.json" },
-    { "id": "security-secrets-management-US-8107", "kind": "us", "path": "user-stories/security-secrets-management-us-8107.json" },
-    { "id": "security-secrets-management-US-8108", "kind": "us", "path": "user-stories/security-secrets-management-us-8108.json" },
-    { "id": "security-secrets-management-US-8109", "kind": "us", "path": "user-stories/security-secrets-management-us-8109.json" },
-    { "id": "security-secrets-management-US-8110", "kind": "us", "path": "user-stories/security-secrets-management-us-8110.json" },
-    { "id": "TAC-901-security-secrets-management-manager-client", "kind": "tac", "path": "tacs/tac-901-security-secrets-management-manager-client.json" },
-    { "id": "TAC-902-security-secrets-management-manifest", "kind": "tac", "path": "tacs/tac-902-security-secrets-management-manifest.json" },
-    { "id": "TAC-903-security-secrets-management-env-reflector", "kind": "tac", "path": "tacs/tac-903-security-secrets-management-env-reflector.json" },
-    { "id": "TAC-904-security-secrets-management-rotation-gate", "kind": "tac", "path": "tacs/tac-904-security-secrets-management-rotation-gate.json" },
-    { "id": "TAC-905-security-secrets-management-agent-cli", "kind": "tac", "path": "tacs/tac-905-security-secrets-management-agent-cli.json" },
+    {
+      "id": "security-secrets-management-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-001.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-002.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-003.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-004.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-005.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-006.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-007.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-008.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-009.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-010.json"
+    },
+    {
+      "id": "security-secrets-management-US-8101",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8101.json"
+    },
+    {
+      "id": "security-secrets-management-US-8102",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8102.json"
+    },
+    {
+      "id": "security-secrets-management-US-8103",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8103.json"
+    },
+    {
+      "id": "security-secrets-management-US-8104",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8104.json"
+    },
+    {
+      "id": "security-secrets-management-US-8105",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8105.json"
+    },
+    {
+      "id": "security-secrets-management-US-8106",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8106.json"
+    },
+    {
+      "id": "security-secrets-management-US-8107",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8107.json"
+    },
+    {
+      "id": "security-secrets-management-US-8108",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8108.json"
+    },
+    {
+      "id": "security-secrets-management-US-8109",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8109.json"
+    },
+    {
+      "id": "security-secrets-management-US-8110",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8110.json"
+    },
+    {
+      "id": "TAC-901-security-secrets-management-manager-client",
+      "kind": "tac",
+      "path": "tacs/tac-901-security-secrets-management-manager-client.json"
+    },
+    {
+      "id": "TAC-902-security-secrets-management-manifest",
+      "kind": "tac",
+      "path": "tacs/tac-902-security-secrets-management-manifest.json"
+    },
+    {
+      "id": "TAC-903-security-secrets-management-env-reflector",
+      "kind": "tac",
+      "path": "tacs/tac-903-security-secrets-management-env-reflector.json"
+    },
+    {
+      "id": "TAC-904-security-secrets-management-rotation-gate",
+      "kind": "tac",
+      "path": "tacs/tac-904-security-secrets-management-rotation-gate.json"
+    },
+    {
+      "id": "TAC-905-security-secrets-management-agent-cli",
+      "kind": "tac",
+      "path": "tacs/tac-905-security-secrets-management-agent-cli.json"
+    },
     {
       "id": "ADR-901-security-secrets-management-secrets-source",
       "kind": "adr",
@@ -36,9 +138,45 @@
       "scope": "global",
       "topic": "secretsSource"
     },
-    { "id": "ADR-902-security-secrets-management-default-vendor", "kind": "adr", "path": "adrs/adr-902-security-secrets-management-default-vendor.json" },
-    { "id": "ADR-903-security-secrets-management-agent-access-discipline", "kind": "adr", "path": "adrs/adr-903-security-secrets-management-agent-access-discipline.json" },
-    { "id": "ADR-904-security-secrets-management-dotenv-reflection", "kind": "adr", "path": "adrs/adr-904-security-secrets-management-dotenv-reflection.json" },
-    { "id": "ADR-905-security-secrets-management-rotation-and-audit", "kind": "adr", "path": "adrs/adr-905-security-secrets-management-rotation-and-audit.json" }
-  ]
+    {
+      "id": "ADR-902-security-secrets-management-default-vendor",
+      "kind": "adr",
+      "path": "adrs/adr-902-security-secrets-management-default-vendor.json"
+    },
+    {
+      "id": "ADR-903-security-secrets-management-agent-access-discipline",
+      "kind": "adr",
+      "path": "adrs/adr-903-security-secrets-management-agent-access-discipline.json"
+    },
+    {
+      "id": "ADR-904-security-secrets-management-dotenv-reflection",
+      "kind": "adr",
+      "path": "adrs/adr-904-security-secrets-management-dotenv-reflection.json"
+    },
+    {
+      "id": "ADR-905-security-secrets-management-rotation-and-audit",
+      "kind": "adr",
+      "path": "adrs/adr-905-security-secrets-management-rotation-and-audit.json"
+    }
+  ],
+  "elicits": [
+    {
+      "id": "environment-set",
+      "prompt": "Which environments does this project run in? Provide the ordered list (for example dev, ci, live). This becomes the manifest header and every `secrets.yaml` entry's `paths` object must key its per-environment path against this list exactly.",
+      "kind": "string",
+      "default": "dev,ci,live"
+    },
+    {
+      "id": "ui-outcome",
+      "prompt": "How should the Secrets Management operator surface be delivered on this project?",
+      "kind": "enum",
+      "default": "none",
+      "options": [
+        "integrate",
+        "admin-spa",
+        "none"
+      ]
+    }
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-secrets-management/contributions/probes/add-recipient-rotation.mjs

@@ -0,0 +1,107 @@
+// Add-recipient rotation probe. Encrypts a scratch scope with age
+// recipient A; adds age recipient B via sops --rotate --add-age;
+// asserts the ciphertext's sops.age[] list now includes both
+// recipients; asserts recipient B can decrypt the file with only
+// its own age key. Proves the shipped rotation verb both extends
+// the recipient list and re-wraps the data key against the new
+// recipient.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+// --rotate --add-age property. Row reads AMBER on criterion e
+// (unanchored vendor-conformance evidence for ADR-902's default
+// vendor sops+age).
+// accountBound: false.
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native rotation.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scopeA = await createScratchAgeScope({ prefix: 'pxe-secrets-a-' });
+  const scopeB = await createScratchAgeScope({ prefix: 'pxe-secrets-b-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipientA: scopeA.recipient, recipientB: scopeB.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scopeA.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'rotation-probe' }, null, 2) + '\n';
+    await writeFile(join(scopeA.dir, 'scope.json'), plaintext, 'utf8');
+
+    // Encrypt against recipient A.
+    const enc = runSops(
+      ['--age', scopeA.recipient, '--encrypt', '--output', cipherPath, join(scopeA.dir, 'scope.json')],
+      { env: sopsEnv(scopeA.keyPath) },
+    );
+    if (enc.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native initial encrypt failed (no AC anchor) status=${enc.status} stderr=${enc.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const before = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaBefore = before;
+
+    // Rotate: add recipient B in-place. sops --rotate --in-place --add-age <B>
+    const rot = runSops(
+      ['--rotate', '--in-place', '--add-age', scopeB.recipient, cipherPath],
+      { env: sopsEnv(scopeA.keyPath) },
+    );
+    if (rot.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native --rotate failed (no AC anchor) status=${rot.status} stderr=${rot.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const after = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaAfter = after;
+
+    // Assertion 1: recipient list grew and now contains B.
+    const bothRecipients = after.recipients.includes(scopeA.recipient) && after.recipients.includes(scopeB.recipient);
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: bothRecipients ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate --add-age observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipients after rotation: ${JSON.stringify(after.recipients)}; bothPresent=${bothRecipients}`,
+      evidence: { before: before.recipients, after: after.recipients },
+    });
+
+    // Assertion 2: mac changed (data key re-wrapped => the payload's MAC is regenerated).
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: after.mac !== before.mac ? 'pass' : 'fail',
+      detail: `SOPS-native MAC divergence observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mac before=${before.mac && before.mac.slice(0, 16)}... after=${after.mac && after.mac.slice(0, 16)}... diverged=${after.mac !== before.mac}`,
+      evidence: { macDiverged: after.mac !== before.mac },
+    });
+
+    // Assertion 3: recipient B can decrypt with only its key.
+    const decB = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeB.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: decB.status === 0 && JSON.stringify(JSON.parse(decB.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native new-recipient decrypt observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipient B decrypt status=${decB.status} matchesPlaintext=${JSON.stringify(JSON.parse(decB.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { statusB: decB.status, stdoutLen: decB.stdout.length },
+    });
+  } finally {
+    await scopeA.cleanup();
+    await scopeB.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/encrypt-decrypt-round-trip.mjs

@@ -0,0 +1,122 @@
+// Encrypt / decrypt round-trip probe for security-secrets-management.
+// Generates a throwaway age keypair in the operator's scratchpad,
+// encrypts a scratch scope file with sops (binary mode so bytes are
+// preserved verbatim), records the sops.mac + sops.lastmodified
+// metadata, decrypts back to the original bytes, and asserts BYTE
+// equality (not JSON equality) between the original file and the
+// decrypted stream. Positive evidence per rule 7d shape 2: the sops
+// metadata excerpt (mac, lastmodified, recipient list) captured
+// from the ciphertext.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+//   byte-equality property this probe evidences, so the probe is
+//   left unanchored (anchorAcId=null) and records the evidence as
+//   vendor-conformance for ADR-902's default vendor (sops+age).
+//   The slug reads AMBER on criterion e until a manager-client
+//   probe is added that observes AC-8102-1 at the module boundary.
+// accountBound: false (real sops+age engine on this machine).
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash, randomBytes } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC or REQ observes the SOPS-native encrypt/decrypt/rotation/mismatched-key property; see probe file comment.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+
+export default async function runProbe() {
+  const scope = await createScratchAgeScope();
+  const evidence = { envDeclared: [...DECLARED_ENV], scopeDir: scope.dir, recipient: scope.recipient };
+  const results = [];
+  try {
+    const plainPath = join(scope.dir, 'scope.bin');
+    const cipherPath = join(scope.dir, 'scope.enc.json');
+    // Use raw random bytes plus a marker so a real byte compare is
+    // meaningful (JSON round-tripping reformats and defeats byte
+    // equality; --input-type binary preserves the exact stream).
+    const plaintextBytes = Buffer.concat([Buffer.from('pxe-secrets:'), randomBytes(256)]);
+    await writeFile(plainPath, plaintextBytes);
+
+    // Encrypt with sops --input-type binary --output-type binary
+    // against the throwaway age recipient.
+    const encRes = runSops(
+      ['--age', scope.recipient, '--input-type', 'binary', '--output-type', 'json', '--encrypt', '--output', cipherPath, plainPath],
+      { env: sopsEnv(scope.keyPath) },
+    );
+    if (encRes.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+        anchorAcId, capability, verdict: 'fail',
+        detail: `SOPS-native encrypt failed (vendor-conformance evidence for ADR-902 sops+age; no AC/REQ anchor) status=${encRes.status} stderr=${encRes.stderr.slice(0, 200)}`,
+        evidence: { encStatus: encRes.status, encStderr: encRes.stderr.slice(0, 200) },
+      });
+      return { results, extra: evidence };
+    }
+    const cipherText = await readFile(cipherPath, 'utf8');
+    const cipherMeta = readSopsMetadata(cipherText);
+    evidence.cipherMeta = cipherMeta;
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: cipherMeta.mac && cipherMeta.lastmodified && cipherMeta.recipients.includes(scope.recipient) ? 'pass' : 'fail',
+      detail: `SOPS-native ciphertext-metadata observation (vendor-conformance evidence for ADR-902's default vendor sops+age; NO AC or REQ states the SOPS-native property this probe observes; slug reads AMBER on criterion e until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at its own boundary (AC-8102-1)). mac=${cipherMeta.mac ? cipherMeta.mac.slice(0, 40) : null} lastmodified=${cipherMeta.lastmodified} recipients=${JSON.stringify(cipherMeta.recipients)}`,
+      evidence: { sopsMetadata: cipherMeta, notObservableACsOrREQs: 'SOPS-native crypto layer; slug is AMBER on criterion-e until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at its boundary.' },
+    });
+
+    // Decrypt with sops --output <file> so binary bytes survive the
+    // spawnSync string-encoded stdout channel (utf8 replacement would
+    // otherwise corrupt any non-utf8 byte before the compare).
+    const decryptedPath = join(scope.dir, 'scope.dec.bin');
+    const decRes = runSops(
+      ['--decrypt', '--input-type', 'json', '--output-type', 'binary', '--output', decryptedPath, cipherPath],
+      { env: sopsEnv(scope.keyPath) },
+    );
+    if (decRes.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+        anchorAcId, capability, verdict: 'fail',
+        detail: `SOPS-native decrypt failed (vendor-conformance evidence for ADR-902 sops+age; no AC/REQ anchor) status=${decRes.status} stderr=${decRes.stderr.slice(0, 200)}`,
+        evidence: { decStatus: decRes.status, decStderr: decRes.stderr.slice(0, 200) },
+      });
+      return { results, extra: evidence };
+    }
+    const decryptedBytes = await readFile(decryptedPath);
+    const originalBytes = plaintextBytes;
+    const originalHash = createHash('sha256').update(originalBytes).digest('hex');
+    const decryptedHash = createHash('sha256').update(decryptedBytes).digest('hex');
+    const bytesEqual = originalBytes.length === decryptedBytes.length && Buffer.compare(originalBytes, decryptedBytes) === 0;
+    evidence.byteCompare = {
+      originalLength: originalBytes.length,
+      decryptedLength: decryptedBytes.length,
+      originalSha256: originalHash,
+      decryptedSha256: decryptedHash,
+      bytesEqual,
+    };
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: bytesEqual ? 'pass' : 'fail',
+      detail: `SOPS-native byte-equality on the encrypt/decrypt round-trip (Buffer.compare === 0 on the raw bytes; vendor-conformance evidence for ADR-902 sops+age; no AC or REQ anchors this property; row reads AMBER). originalLength=${originalBytes.length} decryptedLength=${decryptedBytes.length} sha256(original)=${originalHash.slice(0, 16)} sha256(decrypted)=${decryptedHash.slice(0, 16)} bufferCompareZero=${bytesEqual}`,
+      evidence: { ...evidence.byteCompare, notObservableACsOrREQs: 'SOPS-native crypto layer; slug is AMBER on criterion-e until a manager-client probe is added.' },
+    });
+  } finally {
+    await scope.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/key-rotation.mjs

@@ -0,0 +1,93 @@
+// Key-rotation probe. Encrypts a scratch scope with age recipient
+// A; runs sops --rotate --in-place with the same recipient list;
+// asserts the payload mac changed (new data key => new MAC) while
+// the recipient list is unchanged. Proves the sops rotation verb
+// re-keys the payload without touching the recipient set.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native --rotate
+// property. Row reads AMBER on criterion e (unanchored
+// vendor-conformance evidence for ADR-902's default vendor sops+age)
+// until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at
+// its own boundary (AC-8102-1).
+// accountBound: false.
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native rotation; see probe file header.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scope = await createScratchAgeScope({ prefix: 'pxe-secrets-rot-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipient: scope.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scope.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'rotate-only' }, null, 2) + '\n';
+    await writeFile(join(scope.dir, 'scope.json'), plaintext, 'utf8');
+    const enc = runSops(['--age', scope.recipient, '--encrypt', '--output', cipherPath, join(scope.dir, 'scope.json')],
+      { env: sopsEnv(scope.keyPath) });
+    if (enc.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native initial encrypt failed (no AC anchor) status=${enc.status} stderr=${enc.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const before = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    const rot = runSops(['--rotate', '--in-place', cipherPath], { env: sopsEnv(scope.keyPath) });
+    if (rot.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native --rotate failed (no AC anchor) status=${rot.status} stderr=${rot.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const after = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaBefore = before; evidence.metaAfter = after;
+
+    // Recipient list unchanged.
+    const sameRecipients = JSON.stringify(before.recipients) === JSON.stringify(after.recipients);
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: sameRecipients ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipients unchanged across --rotate: before=${JSON.stringify(before.recipients)} after=${JSON.stringify(after.recipients)}`,
+      evidence: { sameRecipients },
+    });
+
+    // MAC changed (new data key).
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: after.mac !== before.mac ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate MAC divergence observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mac diverged after --rotate: before=${before.mac.slice(0, 64)} after=${after.mac.slice(0, 64)}...`,
+      evidence: { macBefore: before.mac, macAfter: after.mac },
+    });
+
+    // Decryption still works with the same key.
+    const dec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scope.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: dec.status === 0 && JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native post-rotation decrypt observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). post-rotation decrypt: status=${dec.status} matchesPlaintext=${JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { status: dec.status, matched: JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext)) },
+    });
+  } finally {
+    await scope.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/mismatched-key-refusal.mjs

@@ -0,0 +1,74 @@
+// Mismatched-key refusal probe. Encrypts a scratch scope with age
+// recipient A; attempts to decrypt with age recipient B's key
+// only; asserts sops refuses (non-zero exit, no plaintext on
+// stdout). Proves the shipped adapter fails closed on a wrong
+// key rather than degrading to unencrypted.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+// mismatched-key refusal property. Row reads AMBER on criterion e
+// (unanchored vendor-conformance evidence for ADR-902's default
+// vendor sops+age).
+// accountBound: false.
+
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native mismatched-key refusal.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scopeA = await createScratchAgeScope({ prefix: 'pxe-secrets-mm-a-' });
+  const scopeB = await createScratchAgeScope({ prefix: 'pxe-secrets-mm-b-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipientA: scopeA.recipient, recipientB: scopeB.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scopeA.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'mismatch-probe' }, null, 2) + '\n';
+    await writeFile(join(scopeA.dir, 'scope.json'), plaintext, 'utf8');
+    runSops(['--age', scopeA.recipient, '--encrypt', '--output', cipherPath, join(scopeA.dir, 'scope.json')],
+      { env: sopsEnv(scopeA.keyPath) });
+    // Attempt decrypt with B only.
+    const badDec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeB.keyPath) });
+    evidence.badStatus = badDec.status;
+    evidence.badStderrExcerpt = (badDec.stderr || '').slice(0, 200);
+    const refused = badDec.status !== 0 && !badDec.stdout.includes('mismatch-probe');
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: refused ? 'pass' : 'fail',
+      detail: `SOPS-native mismatched-key refusal observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mismatched-key decrypt refused: exitStatus=${badDec.status} stdoutContainsPlain=${badDec.stdout.includes('mismatch-probe')} stderrExcerpt=${(badDec.stderr || '').slice(0, 200)}`,
+      evidence: { exitStatus: badDec.status, refused },
+    });
+    // Sanity: A can still decrypt.
+    const goodDec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeA.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: goodDec.status === 0 && JSON.stringify(JSON.parse(goodDec.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native correct-key sanity (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). correct-key decrypt sanity: status=${goodDec.status} matched=${JSON.stringify(JSON.parse(goodDec.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { status: goodDec.status },
+    });
+  } finally {
+    await scopeA.cleanup();
+    await scopeB.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}