rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-secrets-management/contributions/probes/add-recipient-rotation.mjs

@@ -0,0 +1,107 @@
+// Add-recipient rotation probe. Encrypts a scratch scope with age
+// recipient A; adds age recipient B via sops --rotate --add-age;
+// asserts the ciphertext's sops.age[] list now includes both
+// recipients; asserts recipient B can decrypt the file with only
+// its own age key. Proves the shipped rotation verb both extends
+// the recipient list and re-wraps the data key against the new
+// recipient.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+// --rotate --add-age property. Row reads AMBER on criterion e
+// (unanchored vendor-conformance evidence for ADR-902's default
+// vendor sops+age).
+// accountBound: false.
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native rotation.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scopeA = await createScratchAgeScope({ prefix: 'pxe-secrets-a-' });
+  const scopeB = await createScratchAgeScope({ prefix: 'pxe-secrets-b-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipientA: scopeA.recipient, recipientB: scopeB.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scopeA.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'rotation-probe' }, null, 2) + '\n';
+    await writeFile(join(scopeA.dir, 'scope.json'), plaintext, 'utf8');
+
+    // Encrypt against recipient A.
+    const enc = runSops(
+      ['--age', scopeA.recipient, '--encrypt', '--output', cipherPath, join(scopeA.dir, 'scope.json')],
+      { env: sopsEnv(scopeA.keyPath) },
+    );
+    if (enc.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native initial encrypt failed (no AC anchor) status=${enc.status} stderr=${enc.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const before = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaBefore = before;
+
+    // Rotate: add recipient B in-place. sops --rotate --in-place --add-age <B>
+    const rot = runSops(
+      ['--rotate', '--in-place', '--add-age', scopeB.recipient, cipherPath],
+      { env: sopsEnv(scopeA.keyPath) },
+    );
+    if (rot.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native --rotate failed (no AC anchor) status=${rot.status} stderr=${rot.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const after = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaAfter = after;
+
+    // Assertion 1: recipient list grew and now contains B.
+    const bothRecipients = after.recipients.includes(scopeA.recipient) && after.recipients.includes(scopeB.recipient);
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: bothRecipients ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate --add-age observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipients after rotation: ${JSON.stringify(after.recipients)}; bothPresent=${bothRecipients}`,
+      evidence: { before: before.recipients, after: after.recipients },
+    });
+
+    // Assertion 2: mac changed (data key re-wrapped => the payload's MAC is regenerated).
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: after.mac !== before.mac ? 'pass' : 'fail',
+      detail: `SOPS-native MAC divergence observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mac before=${before.mac && before.mac.slice(0, 16)}... after=${after.mac && after.mac.slice(0, 16)}... diverged=${after.mac !== before.mac}`,
+      evidence: { macDiverged: after.mac !== before.mac },
+    });
+
+    // Assertion 3: recipient B can decrypt with only its key.
+    const decB = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeB.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: decB.status === 0 && JSON.stringify(JSON.parse(decB.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native new-recipient decrypt observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipient B decrypt status=${decB.status} matchesPlaintext=${JSON.stringify(JSON.parse(decB.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { statusB: decB.status, stdoutLen: decB.stdout.length },
+    });
+  } finally {
+    await scopeA.cleanup();
+    await scopeB.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/encrypt-decrypt-round-trip.mjs

@@ -0,0 +1,122 @@
+// Encrypt / decrypt round-trip probe for security-secrets-management.
+// Generates a throwaway age keypair in the operator's scratchpad,
+// encrypts a scratch scope file with sops (binary mode so bytes are
+// preserved verbatim), records the sops.mac + sops.lastmodified
+// metadata, decrypts back to the original bytes, and asserts BYTE
+// equality (not JSON equality) between the original file and the
+// decrypted stream. Positive evidence per rule 7d shape 2: the sops
+// metadata excerpt (mac, lastmodified, recipient list) captured
+// from the ciphertext.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+//   byte-equality property this probe evidences, so the probe is
+//   left unanchored (anchorAcId=null) and records the evidence as
+//   vendor-conformance for ADR-902's default vendor (sops+age).
+//   The slug reads AMBER on criterion e until a manager-client
+//   probe is added that observes AC-8102-1 at the module boundary.
+// accountBound: false (real sops+age engine on this machine).
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash, randomBytes } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC or REQ observes the SOPS-native encrypt/decrypt/rotation/mismatched-key property; see probe file comment.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+
+export default async function runProbe() {
+  const scope = await createScratchAgeScope();
+  const evidence = { envDeclared: [...DECLARED_ENV], scopeDir: scope.dir, recipient: scope.recipient };
+  const results = [];
+  try {
+    const plainPath = join(scope.dir, 'scope.bin');
+    const cipherPath = join(scope.dir, 'scope.enc.json');
+    // Use raw random bytes plus a marker so a real byte compare is
+    // meaningful (JSON round-tripping reformats and defeats byte
+    // equality; --input-type binary preserves the exact stream).
+    const plaintextBytes = Buffer.concat([Buffer.from('pxe-secrets:'), randomBytes(256)]);
+    await writeFile(plainPath, plaintextBytes);
+
+    // Encrypt with sops --input-type binary --output-type binary
+    // against the throwaway age recipient.
+    const encRes = runSops(
+      ['--age', scope.recipient, '--input-type', 'binary', '--output-type', 'json', '--encrypt', '--output', cipherPath, plainPath],
+      { env: sopsEnv(scope.keyPath) },
+    );
+    if (encRes.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+        anchorAcId, capability, verdict: 'fail',
+        detail: `SOPS-native encrypt failed (vendor-conformance evidence for ADR-902 sops+age; no AC/REQ anchor) status=${encRes.status} stderr=${encRes.stderr.slice(0, 200)}`,
+        evidence: { encStatus: encRes.status, encStderr: encRes.stderr.slice(0, 200) },
+      });
+      return { results, extra: evidence };
+    }
+    const cipherText = await readFile(cipherPath, 'utf8');
+    const cipherMeta = readSopsMetadata(cipherText);
+    evidence.cipherMeta = cipherMeta;
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: cipherMeta.mac && cipherMeta.lastmodified && cipherMeta.recipients.includes(scope.recipient) ? 'pass' : 'fail',
+      detail: `SOPS-native ciphertext-metadata observation (vendor-conformance evidence for ADR-902's default vendor sops+age; NO AC or REQ states the SOPS-native property this probe observes; slug reads AMBER on criterion e until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at its own boundary (AC-8102-1)). mac=${cipherMeta.mac ? cipherMeta.mac.slice(0, 40) : null} lastmodified=${cipherMeta.lastmodified} recipients=${JSON.stringify(cipherMeta.recipients)}`,
+      evidence: { sopsMetadata: cipherMeta, notObservableACsOrREQs: 'SOPS-native crypto layer; slug is AMBER on criterion-e until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at its boundary.' },
+    });
+
+    // Decrypt with sops --output <file> so binary bytes survive the
+    // spawnSync string-encoded stdout channel (utf8 replacement would
+    // otherwise corrupt any non-utf8 byte before the compare).
+    const decryptedPath = join(scope.dir, 'scope.dec.bin');
+    const decRes = runSops(
+      ['--decrypt', '--input-type', 'json', '--output-type', 'binary', '--output', decryptedPath, cipherPath],
+      { env: sopsEnv(scope.keyPath) },
+    );
+    if (decRes.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+        anchorAcId, capability, verdict: 'fail',
+        detail: `SOPS-native decrypt failed (vendor-conformance evidence for ADR-902 sops+age; no AC/REQ anchor) status=${decRes.status} stderr=${decRes.stderr.slice(0, 200)}`,
+        evidence: { decStatus: decRes.status, decStderr: decRes.stderr.slice(0, 200) },
+      });
+      return { results, extra: evidence };
+    }
+    const decryptedBytes = await readFile(decryptedPath);
+    const originalBytes = plaintextBytes;
+    const originalHash = createHash('sha256').update(originalBytes).digest('hex');
+    const decryptedHash = createHash('sha256').update(decryptedBytes).digest('hex');
+    const bytesEqual = originalBytes.length === decryptedBytes.length && Buffer.compare(originalBytes, decryptedBytes) === 0;
+    evidence.byteCompare = {
+      originalLength: originalBytes.length,
+      decryptedLength: decryptedBytes.length,
+      originalSha256: originalHash,
+      decryptedSha256: decryptedHash,
+      bytesEqual,
+    };
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: bytesEqual ? 'pass' : 'fail',
+      detail: `SOPS-native byte-equality on the encrypt/decrypt round-trip (Buffer.compare === 0 on the raw bytes; vendor-conformance evidence for ADR-902 sops+age; no AC or REQ anchors this property; row reads AMBER). originalLength=${originalBytes.length} decryptedLength=${decryptedBytes.length} sha256(original)=${originalHash.slice(0, 16)} sha256(decrypted)=${decryptedHash.slice(0, 16)} bufferCompareZero=${bytesEqual}`,
+      evidence: { ...evidence.byteCompare, notObservableACsOrREQs: 'SOPS-native crypto layer; slug is AMBER on criterion-e until a manager-client probe is added.' },
+    });
+  } finally {
+    await scope.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/key-rotation.mjs

@@ -0,0 +1,93 @@
+// Key-rotation probe. Encrypts a scratch scope with age recipient
+// A; runs sops --rotate --in-place with the same recipient list;
+// asserts the payload mac changed (new data key => new MAC) while
+// the recipient list is unchanged. Proves the sops rotation verb
+// re-keys the payload without touching the recipient set.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native --rotate
+// property. Row reads AMBER on criterion e (unanchored
+// vendor-conformance evidence for ADR-902's default vendor sops+age)
+// until a manager-client probe is added that observes the Secrets Manager module (get, getRequired, list, refresh) at
+// its own boundary (AC-8102-1).
+// accountBound: false.
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops, readSopsMetadata } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native rotation; see probe file header.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scope = await createScratchAgeScope({ prefix: 'pxe-secrets-rot-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipient: scope.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scope.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'rotate-only' }, null, 2) + '\n';
+    await writeFile(join(scope.dir, 'scope.json'), plaintext, 'utf8');
+    const enc = runSops(['--age', scope.recipient, '--encrypt', '--output', cipherPath, join(scope.dir, 'scope.json')],
+      { env: sopsEnv(scope.keyPath) });
+    if (enc.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native initial encrypt failed (no AC anchor) status=${enc.status} stderr=${enc.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const before = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    const rot = runSops(['--rotate', '--in-place', cipherPath], { env: sopsEnv(scope.keyPath) });
+    if (rot.status !== 0) {
+      results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM, anchorAcId, capability, verdict: 'fail', detail: `SOPS-native --rotate failed (no AC anchor) status=${rot.status} stderr=${rot.stderr.slice(0, 200)}` });
+      return { results, extra: evidence };
+    }
+    const after = readSopsMetadata(await readFile(cipherPath, 'utf8'));
+    evidence.metaBefore = before; evidence.metaAfter = after;
+
+    // Recipient list unchanged.
+    const sameRecipients = JSON.stringify(before.recipients) === JSON.stringify(after.recipients);
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: sameRecipients ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). recipients unchanged across --rotate: before=${JSON.stringify(before.recipients)} after=${JSON.stringify(after.recipients)}`,
+      evidence: { sameRecipients },
+    });
+
+    // MAC changed (new data key).
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: after.mac !== before.mac ? 'pass' : 'fail',
+      detail: `SOPS-native --rotate MAC divergence observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mac diverged after --rotate: before=${before.mac.slice(0, 64)} after=${after.mac.slice(0, 64)}...`,
+      evidence: { macBefore: before.mac, macAfter: after.mac },
+    });
+
+    // Decryption still works with the same key.
+    const dec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scope.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: dec.status === 0 && JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native post-rotation decrypt observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). post-rotation decrypt: status=${dec.status} matchesPlaintext=${JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { status: dec.status, matched: JSON.stringify(JSON.parse(dec.stdout)) === JSON.stringify(JSON.parse(plaintext)) },
+    });
+  } finally {
+    await scope.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/mismatched-key-refusal.mjs

@@ -0,0 +1,74 @@
+// Mismatched-key refusal probe. Encrypts a scratch scope with age
+// recipient A; attempts to decrypt with age recipient B's key
+// only; asserts sops refuses (non-zero exit, no plaintext on
+// stdout). Proves the shipped adapter fails closed on a wrong
+// key rather than degrading to unencrypted.
+//
+// capability: secretsProvider.
+// Anchor honesty. No AC or REQ observes the SOPS-native
+// mismatched-key refusal property. Row reads AMBER on criterion e
+// (unanchored vendor-conformance evidence for ADR-902's default
+// vendor sops+age).
+// accountBound: false.
+
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createScratchAgeScope, DECLARED_ENV } from './probe-utils.mjs';
+import { runSops } from '../../../../packages/rcf-lite/test/fixtures/security-secrets-management/src/sops-cli.mjs';
+
+
+// Probes pass an explicit minimal env to sops children, never a
+// spread of the entire ambient process.env. Only SOPS_AGE_KEY_FILE,
+// PATH and HOME are forwarded; the fixture README's env-var table
+// is the declared surface.
+function sopsEnv(keyPath) {
+  return {
+    SOPS_AGE_KEY_FILE: keyPath,
+    PATH: process.env.PATH || '',
+    HOME: process.env.HOME || '',
+  };
+}
+const CONFORMANCE_LIM = "security-secrets-management-AC-8102-1: probe drives the SOPS binary at the crypto layer; the AC states the project exposes one Secrets Manager module (get, getRequired, list, refresh) that is the only importer of the vendor binding, which requires observing the deployed manager through the integration harness follow-up.";
+export const anchorAcId = null; // No AC/REQ observes SOPS-native mismatched-key refusal.
+export const capability = 'secretsProvider';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const scopeA = await createScratchAgeScope({ prefix: 'pxe-secrets-mm-a-' });
+  const scopeB = await createScratchAgeScope({ prefix: 'pxe-secrets-mm-b-' });
+  const evidence = { envDeclared: [...DECLARED_ENV], recipientA: scopeA.recipient, recipientB: scopeB.recipient };
+  const results = [];
+  try {
+    const cipherPath = join(scopeA.dir, 'scope.enc.json');
+    const plaintext = JSON.stringify({ v: 'mismatch-probe' }, null, 2) + '\n';
+    await writeFile(join(scopeA.dir, 'scope.json'), plaintext, 'utf8');
+    runSops(['--age', scopeA.recipient, '--encrypt', '--output', cipherPath, join(scopeA.dir, 'scope.json')],
+      { env: sopsEnv(scopeA.keyPath) });
+    // Attempt decrypt with B only.
+    const badDec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeB.keyPath) });
+    evidence.badStatus = badDec.status;
+    evidence.badStderrExcerpt = (badDec.stderr || '').slice(0, 200);
+    const refused = badDec.status !== 0 && !badDec.stdout.includes('mismatch-probe');
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId,
+      capability,
+      verdict: refused ? 'pass' : 'fail',
+      detail: `SOPS-native mismatched-key refusal observation (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). mismatched-key decrypt refused: exitStatus=${badDec.status} stdoutContainsPlain=${badDec.stdout.includes('mismatch-probe')} stderrExcerpt=${(badDec.stderr || '').slice(0, 200)}`,
+      evidence: { exitStatus: badDec.status, refused },
+    });
+    // Sanity: A can still decrypt.
+    const goodDec = runSops(['--decrypt', cipherPath], { env: sopsEnv(scopeA.keyPath) });
+    results.push({ conformanceOnly: true, limitation: CONFORMANCE_LIM,
+      anchorAcId: null,
+      capability,
+      verdict: goodDec.status === 0 && JSON.stringify(JSON.parse(goodDec.stdout)) === JSON.stringify(JSON.parse(plaintext)) ? 'pass' : 'fail',
+      detail: `SOPS-native correct-key sanity (vendor-conformance for ADR-902 sops+age; no AC/REQ anchor; row AMBER). correct-key decrypt sanity: status=${goodDec.status} matched=${JSON.stringify(JSON.parse(goodDec.stdout)) === JSON.stringify(JSON.parse(plaintext))}`,
+      evidence: { status: goodDec.status },
+    });
+  } finally {
+    await scopeA.cleanup();
+    await scopeB.cleanup();
+    evidence.cleanedUp = true;
+  }
+  return { results, extra: evidence };
+}

package/blueprints/security-secrets-management/contributions/probes/probe-utils.mjs

@@ -0,0 +1,214 @@
+// Shared helpers for security-secrets-management probes.
+//
+// Engine posture: sops (v3.x) + age (v1.x) are real, in-process
+// engines on the developer machine. Every probe runs against a
+// throwaway age recipient the probe itself generates in a scratch
+// directory under the operator's scratchpad, encrypts a scratch
+// scope file, and cleans up on completion. The estate's canonical
+// vault (repo-root .vault/) is NEVER touched.
+//
+// SOPS metadata (lastmodified, mac, unencrypted_suffix, and the
+// recipients array under sops.age[]) is inspected as positive
+// evidence per rule 7d shape 2 (response-body excerpt): a before/
+// after MAC divergence proves the encrypt/decrypt cycle mutated
+// the file; a recipient added to sops.age[] proves the rotation
+// verb succeeded.
+
+import { mkdir, writeFile, mkdtemp, rm } from 'node:fs/promises';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { tmpdir } from 'node:os';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-secrets-management';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-secrets-management');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-secrets-management');
+
+export const DECLARED_ENV = Object.freeze([
+  'SOPS_AGE_KEY_FILE',
+  'RCF_SECRETS_SCRATCH_DIR',
+  'PATH',
+  'HOME',
+]);
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = { slug: 'security-secrets-management', probeName, runAt: new Date().toISOString(), engine, results: prefixedResults, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: 'unknown', verdict: 'fail', detail: `probe threw: ${err && err.message ? err.message : String(err)}` }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Creates a scratch working dir under RCF_SECRETS_SCRATCH_DIR (or
+// the OS tmpdir), generates a fresh throwaway age keypair inside
+// it and writes the key to a file the caller can point sops at.
+// Returns { dir, keyPath, recipient } and a cleanup function.
+import { execFileSync } from 'node:child_process';
+
+// Engine-absent detection. The security-secrets-management probes
+// drive real age + sops binaries in-process; when either binary is
+// missing on the host (a stock Ubuntu runner without the install
+// step; a bare macOS box) the honest posture is a skip that names
+// the missing engine, not an ENOENT throw from execFileSync. The
+// anatomy test consumes this reason and records a skip row shaped
+// `{ notObservableHere: { ac, reason } }` rather than failing.
+const ENGINE_ABSENT_REASON = 'age or sops binary absent on this host';
+const REQUIRED_ENGINE_BINARIES = Object.freeze(['age-keygen', 'sops']);
+export function engineAbsentReason() {
+  for (const bin of REQUIRED_ENGINE_BINARIES) {
+    try { execFileSync(bin, ['--version'], { stdio: 'ignore' }); }
+    catch { return ENGINE_ABSENT_REASON; }
+  }
+  return null;
+}
+export class EngineAbsentError extends Error {
+  constructor() {
+    super(ENGINE_ABSENT_REASON);
+    this.name = 'EngineAbsentError';
+    this.engineAbsent = true;
+    this.reason = ENGINE_ABSENT_REASON;
+  }
+}
+
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export async function createScratchAgeScope({ prefix = 'pxe-secrets-' } = {}) {
+  // Engine-absent probes must never reach execFileSync('age-keygen')
+  // and dump an ENOENT stack; the anatomy test's honest posture is a
+  // typed EngineAbsentError the caller can route to a skip row.
+  const absent = engineAbsentReason();
+  if (absent) throw new EngineAbsentError();
+  const base = process.env.RCF_SECRETS_SCRATCH_DIR || tmpdir();
+  await mkdir(base, { recursive: true });
+  const dir = await mkdtemp(join(base, prefix));
+  const keyPath = join(dir, 'age-key.txt');
+  // age-keygen -o <path> writes both public and private key.
+  execFileSync('age-keygen', ['-o', keyPath], { stdio: 'pipe' });
+  // Read the public key line: `# public key: age1...`
+  const keyText = execFileSync('cat', [keyPath], { encoding: 'utf8' });
+  const m = keyText.match(/# public key:\s*(age1[a-z0-9]+)/i);
+  if (!m) throw new Error('age-keygen output missing public key comment');
+  const recipient = m[1];
+  return {
+    dir, keyPath, recipient,
+    async cleanup() { await rm(dir, { recursive: true, force: true }); },
+  };
+}

package/blueprints/security-secrets-management/contributions/probes/run-add-recipient-rotation.mjs

@@ -0,0 +1,4 @@
+import runProbe from './add-recipient-rotation.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'sops+age', image: 'sops(1) --rotate --add-age with throwaway A + B keys', healthy: true };
+runShim('add-recipient-rotation', engine, runProbe);

package/blueprints/security-secrets-management/contributions/probes/run-encrypt-decrypt-round-trip.mjs

@@ -0,0 +1,4 @@
+import runProbe from './encrypt-decrypt-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'sops+age', image: 'sops(1) + age(1) via throwaway keys in scratchpad', healthy: true };
+runShim('encrypt-decrypt-round-trip', engine, runProbe);

package/blueprints/security-secrets-management/contributions/probes/run-key-rotation.mjs

@@ -0,0 +1,4 @@
+import runProbe from './key-rotation.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'sops+age', image: 'sops(1) --rotate --in-place on throwaway scope', healthy: true };
+runShim('key-rotation', engine, runProbe);

package/blueprints/security-secrets-management/contributions/probes/run-mismatched-key-refusal.mjs

@@ -0,0 +1,4 @@
+import runProbe from './mismatched-key-refusal.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'sops+age', image: 'sops(1) fail-closed on wrong age key', healthy: true };
+runShim('mismatched-key-refusal', engine, runProbe);