workspace-manager/.workspace-ops/rules/domains/secrets/rules.md

Workspace Secrets Domain Rules

Scope

This domain covers workspace-level guidance for secret handling with SOPS. It does not store raw secret values and does not replace project-owned secret loading code.

Rules

• Use SOPS for encrypted secret files when a project needs tracked secret material.
• Do not write raw tokens, passwords, private keys, account ids, signing material, or webhook secrets in tracked workspace docs.
• Keep local key material, age identities, GPG private keys, .env files, and decrypted secret output in ignored local files.
• Project docs may describe secret names, injection paths, owners, and expected runtime variables, but not values.
• .workspace-ops/docs/secrets-sops.md is the workspace guide for SOPS usage.
• .workspace-ops/templates/secrets-sops.md is the starter guide for a newly added project that needs SOPS guidance.
• If a project already has stronger local agent-ops or agent-test/local secret rules, follow the project-local rule first and keep workspace docs as inventory/guidance only.
• Secret changes should mention the validation path without exposing values, for example sops -d <file>, app config load test, or remote runner smoke.

Routing

Use .workspace-ops/skills/secrets-management/SKILL.md for requests such as:

• SOPS 기준 정리
• 시크릿 관리 가이드 추가
• 프로젝트 secret 문서 기본형 추가
• raw secret 노출 여부 점검
• .sops.yaml 또는 encrypted secret layout 검토