Role: Secret Manager

Skill: /role-secret-manager · Definition: ~/.claude/agent-prompts/roles/secret-manager.md Context guard: only activates in p24-infra sessions

Charter

Sole authority for all credential operations in the ecosystem: SOPS file edits, API key rotation, secret distribution to servers/Vercel/GH Secrets, and post-incident rotation. No other role touches SOPS files or rotates production credentials.

Scope & Authority

• SOPS+age file edits (all secrets/*.env.sops files)
• Credential rotation for all Tier 1/2 keys (see secret-rotation-access-matrix.md)
• Distribution: secrets-sync.yml trigger, Vercel env update, GH Secrets update
• Credential design and new key onboarding
• Rotation policy enforcement

Escalates to: human (Tier 3 keys — OVH console, physical server access) · /role-sys-admin for container restarts post-rotation

When to invoke

• Any /rotate, expired, revoke, regenerate, new API key, new token task
• Credential incident (exposed key, unauthorized access)
• SOPS file corruption or CRLF/BOM issue
• New service onboarding that needs a secret
• Scheduled rotation (180d window)

Emergency playbooks — read first

Daily operations

• sops-edit-operations.md — standard SOPS edit/add/delete pattern
• credential-rotation-180d.md — scheduled rotation checklist
• credential-automation-registry.md — which rotations are automated vs manual
• secrets-design-standard.md — design new secrets correctly

Full reference library

SOPS Operations

• sops-edit-operations.md — add/edit/delete keys safely on Windows
• sops-powershell-decrypt.md — safe PowerShell decrypt pattern
• sops-rotation-classifier-patterns.md — classify rotation type (Tier 1/2/3)
• sops-windows-crlf.md — CRLF/BOM corruption recovery
• sops-windows-patterns.md — safe write patterns on Windows

Policy & Design

• credential-rotation-policy.md — rotation schedule and rules
• credential-rotation-manual-static.md — manual static key rotation procedure
• credential-rotation-180d.md — 180-day rotation checklist
• credential-automation-registry.md — automated vs manual rotation registry
• secrets-design-standard.md — how to design new secrets
• per-service-credential-isolation-plan.md — service isolation design
• secret-rotation-access-matrix.md — Tier 1/2/3 access matrix
• secret-repo-access-matrix.md — which SOPS file per repo
• master-keys-bootstrap.md — age key bootstrap on new machine
• secret-manager-request.md — how other sessions request credential ops

Incidents

• static-api-key-incident-rotation.md — immediate rotation after exposure
• gh-secret-sops-drift.md — GH Secrets out of sync with SOPS

Specific Rotations — AI / LLM

• anthropic-api-key-rotation.md — Anthropic / Claude API key
• openai-key-management.md — OpenAI key management

Specific Rotations — CI / GitHub

• github-pat-rotation.md — GitHub PAT rotation (p24-workers-ci, p24-n8n-gh)
• gitlab-token-rotation.md — GitLab token rotation
• worker-gh-auth-standard.md — worker GH auth pattern
• worker-github-invite-acceptance.md — worker GitHub invite

Specific Rotations — Communication

• discord-bot-token-rotation.md — Discord bot token
• rotate-discord-bot-token.md — step-by-step Discord rotate
• mailgun-api-key-rotation.md — Mailgun API key
• resend-api-key-rotation.md — Resend API key
• telegram-bot-token-rotation.md — Telegram bot token
• heygen-api-key-rotation.md — HeyGen API key

Specific Rotations — Monitoring & Observability

• grafana-claude-sub-monitoring.md — Grafana Claude subscription monitoring
• mezmo-key-rotation.md — Mezmo (LogDNA) key rotation
• nexcon-api-key-rotation.md — Nexcon API key
• sentry-token-rotation.md — Sentry token rotation
• traccar-admin-key-rotation.md — Traccar admin key

Specific Rotations — Cloud & Infrastructure

• cloudflare-credential-rotation.md — CF Global Key, scoped tokens
• cloudflare-token-rotation-cleanup.md — token cleanup after rotation
• ionos-api-token-rotation.md — IONOS API token
• vercel-token-rotation.md — Vercel API token
• wasabi-key-rotation.md — Wasabi IAM key rotation
• ssh-key-rotation.md — SSH key rotation (all servers)
• claude-runner-oauth-rotation.md — Claude runner OAuth token

Specific Rotations — n8n / Automation

• hstgr-n8n-mcp-token-rotation.md — Hostinger n8n MCP token
• n8n-bms4-api-key-rotation.md — n8n bms-4 API key
• n8n-cloud-api-key-rotation.md — n8n cloud API key
• n8n-cloud-supabase-credential-rotation.md — n8n cloud Supabase credential
• n8n-db-password-rotation.md — n8n database password
• n8n-supabase-credential-rotation.md — n8n Supabase credential drift

Specific Rotations — Supabase

• supabase-access-token-rotation.md — Supabase management access token
• supabase-service-key-rotation.md — Supabase service key (sb_secret_*)

Specific Rotations — App / Pinbox24

• v42-prod-credential-rotation.md — v42-prod full credential rotation
• w3-mongodb-credential-rotation.md — W3 MongoDB app password
• w4-mongodb-credential-rotation.md — W4 MongoDB app password
• mongodb-credential-rotation.md — MongoDB rs0 admin credential
• clickup-api-key-rotation.md — ClickUp API key
• trello-credentials-rotation.md — Trello credentials — playbook not yet written

Specific Rotations — Brand

• brand-credential-rotation.md — brand project credential rotation
• radekkonarski-brand-wasabi-credentials.md — personal brand Wasabi key

Automation Tools

• playwright-rotation-template.md — Playwright template for automated rotation

Related roles