magogi/prod/: mgf-secrets-0.7.0 metadata and description

Simple index

The Foundation credential plane (Phase 1): the committed secrets registry (declared truth, zero values), a read-only doctor that proves declared == deployed == consumed, per-kind liveness probes, and the mgf-secrets CLI. Stdlib-only. Sibling of mgf-common under the mgf.* namespace.

author	Bassam Alsanie, mgf-secrets contributors
classifiers	Development Status :: 2 - Pre-Alpha Intended Audience :: Developers License :: OSI Approved :: Apache Software License Operating System :: OS Independent Programming Language :: Python :: 3 Programming Language :: Python :: 3.11 Programming Language :: Python :: 3.12 Programming Language :: Python :: 3.13 Typing :: Typed
description_content_type	text/markdown
keywords	cli, credentials, doctor, magogi, registry, secrets
license	Apache-2.0
license_file	LICENSE NOTICE
metadata_version	2.4
project_urls	Homepage, https://codeberg.org/magogi-admin/mgf-secrets Issues, https://codeberg.org/magogi-admin/mgf-secrets/issues Changelog, https://codeberg.org/magogi-admin/mgf-secrets/src/branch/main/CHANGELOG.md
requires_dist	pyrage<2,>=1.2 import-linter>=2.0; extra == 'dev' mgf-standard<0.2,>=0.1.6; extra == 'dev' mgf-test-supervisor<0.2,>=0.1.3; extra == 'dev' mypy>=1.10; extra == 'dev' pytest-cov>=5.0; extra == 'dev' pytest-timeout<3,>=2.3; extra == 'dev' pytest>=8.0; extra == 'dev' ruff<0.16,>=0.4; extra == 'dev' mgf-common[standards]<1.0,>=0.47; extra == 'standards'
requires_python	>=3.11

Because this project isn't in the mirror_whitelist, no releases from root/pypi are included.

File	Tox results	History
mgf_secrets-0.7.0-py3-none-any.whl Size 114 KB Type Python Wheel Python 3		Uploaded to magogi/prod by magogi 2026-08-02 04:58:40
mgf_secrets-0.7.0.tar.gz Size 234 KB Type Source		Uploaded to magogi/prod by magogi 2026-08-02 05:00:53

mgf-secrets

The Magogi Foundation credential plane. Phase 1: the committed registry (every credential declared, no values) and a read-only doctor that proves declared == deployed == consumed across every surface — Woodpecker scopes, forge deploy keys, local my_stuff/ caches, and on-host files. Stdlib-only. Sibling of mgf-common under the mgf.* namespace.

Secrets in the Foundation live in five unmanaged planes (plaintext my_stuff/, one shared Woodpecker org pool, forge deploy keys, root-600 host files, doc-prose), and every failure class has already fired in production — always as silent drift. mgf-secrets applies the pattern the estate already trusts: declare → reconcile → verify → page on drift. This repo is Phase 1 of that program: the registry + the read-only doctor. No values are stored, encrypted, or synced yet (that is P2+); nothing here writes to any secret, host, Woodpecker, or forge state.

What it does (P1)

Registry — SECRETS.toml in mgf-standard (family mgf + shared infra) and sooth-standard (family sooth). One entry per credential: kind, surfaces[], policy, rotation, verify, recovery, state. The loader fails closed: a missing field, an unknown kind/surface/state, a duplicate id across families, or a held entry marked armed is a load error (exit 2).
Doctor (mgf-secrets doctor) — read-only checks C1–C8: Woodpecker declared↔actual scopes, consumed↔declared (the CIR-02 audit, ported for parity), unregistered-actual (the steward-class detector), held discipline (the CIR-33 inversion), forge deploy-key coverage (CIR-34), local hygiene (modes, doc-form files, expired JWTs, .bak/old_* leftovers, gitignore), and host-file perms. Human table + --json.
Probes (mgf-secrets probe <id>) — a per-kind, non-destructive liveness check.
list / show — the registry as a table / full metadata (never a value).

Exit codes: 0 clean · 1 findings · 2 usage / credential / load error.

Usage

mgf-secrets list [--family mgf|sooth] [--kind KIND] [--state STATE] [--json]
mgf-secrets show <id> [--json]
mgf-secrets doctor [--surface woodpecker|forge|local|hosts]… [--json]
mgf-secrets probe <id> [--json]

Default doctor surfaces are woodpecker + local; forge and hosts are opt-in (the forge sweep respects the Codeberg rate budget, PAPER-110). The Woodpecker token comes from $WOODPECKER_TOKEN → mgf-standard/my_stuff/woodpecker_token.txt (mint per MGF_INFRA.md §2 on a 401). The registry resolves sibling checkouts from $MGF_ROOT (default ~/PycharmProjects).

Security posture (AG-18)

Secret values never enter this tool's context, output, transcripts, or logs. show and list are metadata-only; doctor C6 decodes a JWT exp in-process and emits only the integer. The redaction property test drives the whole CLI with planted canaries and asserts their absence.

Non-goals (P1)

No store/encryption, no sync, no value-printing verbs, no rotation, and no mutation of any secret, host, Woodpecker, or forge state — Phase 1 is strictly read-only against the world. See the program proposal for the phase table.

devpi