## Summary Repo-committed encrypted secrets for the devstack/CI loop — SOPS + age, canopy's containerized workflow ported and hardened (user-ratified 2026-08-10). Secrets live encrypted in the public tree for authorized maintainers + CI; ONE bootstrap secret (`CRAIG_CI_AGE_KEY`); rotation is a git commit executed as a locked, durable two-phase adoption; identity-less contributors keep the permanent generate-once local path. First migrant: the devstack field-encryption key. v1 design externally reviewed 2026-08-10 (~40 findings, 13 stop-ship) — the architecture is the reviewer's 9-point direction. **Plan**: [repo-committed-secrets.adoc](https://gitlab.com/gadhs/application/ccwis/craig/-/blob/main/docs/modules/ROOT/pages/plans/repo-committed-secrets.adoc) · **ADR**: [ADR-064](https://gitlab.com/gadhs/application/ccwis/craig/-/blob/main/docs/modules/ROOT/pages/adrs/adr-064-repo-committed-encrypted-secrets.adoc) · **Program issue**: #1032 · **Gates**: #1031 (G-A keys+ratification / G-B CI-key proof / G-C old-variable retirement) ## Children - [x] #1378 docs(secrets): plan page + ADR-064 (U0) (weight: 2) - [ ] #1031 chore(secrets): maintainer gates G-A/G-B/G-C (weight: 1) - [x] #1379 feat(xtask): hardened sops/age devtools runner (U1) (weight: 3) - [x] #1380 feat(xtask): secrets_store module + core commands (U2) (weight: 5) - [x] #1381 feat(xtask): recipient management (U3) (weight: 3) - [x] #1382 feat(secrets): committed store + sops-mode lint + secrets-policy job (U4) (weight: 3) - [x] #1383 feat(xtask): field-key store reconciliation (U5) (weight: 5) - [x] #1384 feat(xtask): two-phase lifecycle adoption + blocking rotation test (U6) (weight: 5) - [x] #1385 feat(ci): write-field-key.sh store-mode (U7) (weight: 2) - [x] #1386 docs(secrets): close-out + archive + macro-feedback (U8) (weight: 2) DAG: U0 -> G-A -> U1 -> U2 -> U3 -> U4 -> G-B -> U5 -> U6 -> U7 -> G-C -> U8 (U1-U3 implementable before G-A completes — their tests use throwaway keys only; U4 blocks on G-A, U7 on G-B.) --- **COMPLETE (2026-08-10).** All nine units (U0-U8) + the three maintainer gates (#1031) landed; #1032 closed by !1333 (merge d8ca183b21e9e892e64413c4d498f43815504f6f). Plan archived at `plans/archive/repo-committed-secrets.adoc`; as-built ADR-064 + ADR-048 §D5 + ADR-020. Follow-ups: #1387-#1390.