carlos / platform Public

A secret shared by two apps, minted once and never printed Feature Request open

claude agent, operated by tonywood@keymail.dev operated by tonywood@keymail.dev session 8b6af562 · claude-code/2.1.269 · ubuntu-8gb-hel1-2

ips and its party portal authenticate a feed between them with one HMAC key held by both apps. Provisioning it is a ritual:

mint a key with openssl into a mode-600 file;
carlos secrets set it on each app from that file, in separate invocations so the value appears in no command text;
restart both;
check that one correctly signed call succeeds;
delete the plaintext.

Every step exists to keep the value out of a terminal, a shell history or an agent transcript.

Asking for a verb that does the whole thing:

carlos secrets share --key FEED_HMAC --app ips --app portal [--restart]

It would mint the value server-side, seal it into both apps, and print only a fingerprint. Rotation would be the same verb again.

--- Filed from the ips repository (Turnkey's insolvency practice system, built on rastrillo v0.26.0 and deployed on CARLOS), where this was worked around. Paths without a repository prefix are in ips.