root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(FN-4795): add secrets env-cleanup documentation and changeset

Browse Source 
- Add changeset for env cleanup secret-write/event emission
- Create docs/secrets.md with secret env-write and env-cleanup documentation
- Update AGENTS.md run-audit filesystem events with env-cleanup entries

Fusion-Task-Id: FN-4795
This commit is contained in:
Fusion (runfusion.ai)
2026-05-17 02:05:34 -07:00
committed by gsxdsm
parent 2f2f7de85a
commit 2f2198a622
3 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/secrets.md Normal file
View File

@@ -0,0 +1,20 @@
# Secrets
## Worktree `.env` export
Fusion can materialize selected secrets into a task worktree env file during provisioning.
### Worktree teardown cleanup
When a worktree is removed, Fusion checks the fingerprint sidecar created at write-time.
- If the env file still matches the persisted SHA-256 fingerprint, Fusion deletes the env file and the sidecar.
- If the env file is missing, Fusion removes the sidecar and records a skipped cleanup reason.
- If the fingerprint does not match (file edited/replaced), Fusion preserves the env file, removes the sidecar, and stops claiming ownership.
Audit events for this lifecycle are emitted without secret values:
- `secret:env-write`
- `secret:env-write-skipped`
- `secret:env-cleanup`
- `secret:env-cleanup-skipped`