Status: in progress. OpenBao and both its secrets engines are live. The Mac
container path is in use. The agent pool is declared in infrastructure code and
its converge role is written, with the first canary run outstanding. Each linked
page carries the current status for its workstream.
Seven phases, each independently shippable, each with a rollback. The boundary first, the secrets second, the decommission last.
Phases
1
Profiles + image + local Mac runs (done)
The three autonomy profiles landed in nix-ai; the
nix-agent-sandbox repo
ships agent-image and agent-cli; agent run works via Apple
container on the Mac.2
The agent pool in infrastructure code (done)
A dedicated firewall profile for pooled agent guests — internal services
plus the forward proxy, and no direct outbound web rule — and the proxy
guest that holds the domain allowlist. Both are declared in tofu-proxmox.
3
Pool converge role + canary (role written, canary pending)
The
agent_guest role converges a stock Debian LXC into a queue-pulling
agent guest: one systemd unit per job, credentials rendered per job,
transcripts shipped. The canary is one real job per agent CLI on a pool
guest; the legacy runtime retires only after it passes.4
OpenBao (AWS STS live)
Core OpenBao is deployed. AppRole and response-wrapped bootstrap provide the
machine path. The AWS STS engine now brokers AWS access for automation,
replacing the static aws-vault base key; other
static service credentials continue moving into OpenBao KV.
5
GitHub App service engine
A separate OpenBao engine issues fixed, named permission sets as one-hour
installation tokens. Routine automation PATs retire after live issuance,
use, and revocation checks pass.
6
Consumer migration
Agent launchers consume the GitHub engine. Access outside the configured
full-automation ceiling stays human-only; remaining privileged PATs become
break-glass credentials.
7
Decommission
The legacy agent guests and the launcher zsh they needed are removed once
the pool carries load; routine machine secrets finish moving out of
Doppler; optional credential-injecting proxy for
static-credential backends.
Repo ownership map
Pages this supersedes in part
This section changes the trajectory of several existing pages without rewriting them yet. Until each phase lands, the existing pages describe the live system.- aws-vault — already replaced for automation by the OpenBao AWS STS engine (phase 4); that page now documents the broker model that replaced it.
- Doppler — the four-tier model (see the comparison) keeps Doppler as the strict cloud tier holding secret-zero and rare human-approved credentials; routine machine secrets still migrate out in phase 7 — into OpenBao.
- OpenBao — that page predates this design and described OpenBao as a cluster-local alternative store; the four-tier model assigns OpenBao the single machine-secrets role (dynamic credentials included). The two converge in phase 4.
- SOPS in repos — unchanged in role; stays the layer for committed deployment config.
See also
Overview
The boundary-inversion principle the phases build toward.
Runtime
What phases 1–3 actually construct.
Secrets
What phase 4 migrates, class by class.
GitHub access
What phases 5–6 replace.