[defangdevs]

Part of #922 (PR 1, first slice). Draft: payloads and unit tests only.

What is here

• modules/src/lib/secret-protocol.py: length-prefixed JSON framing (64 KiB cap, checked before allocation), strict request schema that refuses unknown fields, and the record store (0700/0600, directory-fd + O_NOFOLLOW, temp+fsync+rename, flock, namespace bound to user+uid, tombstone on remove).
• modules/src/secret-broker.py: root broker for one user; checks SO_PEERCRED uid; the request cannot pick uid, path or namespace. No operation returns a value.
• modules/src/secret-cli.py: agent-box-secret list | set NAME --stdin | remove NAME.
• tests/test-secret-custody.py: 8 tests over a real Unix socket (python3 tests/test-secret-custody.py).

What is NOT here (so PR 1 stays unchecked on #922)

• No services.agent-box.secrets.enable, units, socket, contract, bin/agentbox wiring or generated module/fixtures.
• No VM test. The OS boundary (agent user cannot read records or the socket, uid spoofing, two users) is unproven; the host that wrote this has no KVM. The unit tests do not claim it.
• Needs privileged-code security review before anything ships.

Open question

Reading meta.json binding stores user as the namespace name; confirm that is the namespace scheme you want before wiring.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE