# `mgf-secrets` — scope policy

> What belongs in the Foundation credential plane (family **SP**). A proposed
> addition is in scope only if it passes the §3 gate.

## §1 In scope (SP-01)

The **governance plane for the Foundation's operational credentials** — CI,
infra, forge, publish. Phase by phase:

- **The registry** — the `SECRETS.toml` schema, loader, and fail-closed
  validator: one declared entry per credential (`kind`, `surfaces[]`, `policy`,
  `rotation`, `verify`, `recovery`, `state`), **zero values**, family-namespaced,
  loaded from both standards checkouts.
- **The doctor** — the read-only verifier that proves *declared == deployed ==
  consumed* on every surface (Woodpecker org/repo scopes, forge deploy keys, host
  files, local caches), absorbing `audit_secret_scopes.py` +
  `verify_secret_scopes.py` and extending them; exits non-zero on drift.
- **Per-kind probes** — non-destructive liveness checks, one per registered kind.
- **The CLI + Python API** — `list` / `show` / `doctor` / `probe` now; the store,
  `sync`, and rotation verbs in later phases (all `--json`, stable exit codes).
- **(later phases)** the age-encrypted store, the materialized-cache writer, the
  per-surface reconciler, and the staged rotation playbooks.

The boundary: this library **governs** credentials (declare, verify, and — later —
reconcile/rotate). Consumers keep reading the same env vars and `my_stuff/` paths;
adopting the Python API is never required.

## §2 Out of scope (SP-02)

| Not here | Why | Where instead |
|---|---|---|
| A secrets **daemon / vault service / VM** | a fifth pet with its own unseal problem; the design is deliberately no-new-service | — (files + git + this CLI) |
| Printing or exporting secret **values** to a screen/transcript | AG-18 — the leak class this program exists to kill | `show --value` / `exec` (P2, TTY-guarded, value-file input only) |
| Forge / Woodpecker **org restructuring** (per-family orgs) | repo migration; deferred to the public flip | recorded in the proposal §8 |
| Defining the **standards corpus** or the infra inventory | those are their own sources of truth | `mgf-standard` (`MGF_INFRA.md`, the corpus) |
| App-level / product user-facing secrets | this is the *operational* credential plane | onboarded later as registry consumers |

## §3 Scope-creep gate (SP-03)

A PR MUST answer: (1) does it keep **zero secret values** in any committed file,
output, or transcript (AG-18)? (2) is the new surface/kind **declared in the
registry and covered by a doctor check + a probe handler + a replay fixture** (no
ungoverned growth)? (3) does it stay **read-only** where the phase says read-only,
and gate any mutation behind an explicit, plan-first, never-silent-delete path?
Any "no/unclear" blocks it.

## §6 Revisiting scope (SP-06)

Revisited at every phase boundary and every MAJOR: re-affirms the no-values,
no-new-service, and no-ungoverned-growth invariants.
