Kevin

Credential Vault — Harvest, Seal & Hydrate

bootstrap_vault harvest → vault.fernet → hydrate_env fills env gaps (explicit env wins).

Credential Vault — Harvest, Seal & Hydrate (v2026-09-30T094150Z-5e473105f4) 2026-09-30 | bootstrap_vault harvest → vault.fernet → hydrate_env fills env gaps (explicit env wins). 1 - BOOTSTRAP - Populate sealed vault from legacy sources bootstrap_vault _load_template() _env_map() _discover_env_files() _read_from_git_credentials() 2 - VAULT - Encrypt and store credentials ~/.kevin/vault.fernet vault.fernet ~/.kevin/vault-key daemon/config/vault-template.yaml 3 - HYDRATE - Fill environment gaps hydrate_env PROVIDER_REGISTRY value_for_alias() split_pool() 1. bootstrap_vault() 2. load template 3. map environment 4. discover files 5. read git creds 6. store encrypted 7. fill environment Vault template YAML version: "2" integrations: ai_token: accounts: anthropic: name: "Anthropic" provider: "anthropic" endpoint: "https://api.anthropic.com" endpoint_env: "ANTHROPIC_BASE_URL" public: true key: "" env_aliases: ["ANTHROPIC_API_KEY"] description: "Claude AI routing and email triage." placeholder: "sk-ant-..." services: ["daemon", "marco"] rotation_days: 90 Environment variable mapping PROVIDER_REGISTRY: anthropic: ("ai_token", ["ANTHROPIC_API_KEY"]) openai: ("credential", ["OPENAI_API_KEY"]) openrouter: ("credential", ["OPENROUTER_API_KEY"]) groq: ("credential", ["GROQ_API_KEYS", "GROQ_API_KEY"]) gemini: ("credential", ["GEMINI_API_KEY", "GOOGLE_API_KEY"]) The vault is the single source of truth for all integration credentials. Environment variables explicitly set take precedence over those from the vault. Legend actor = initiates work · process = code path · store = state on disk · bus = durable queue · dashed = separate process cyan = request flow · pink = state read/write · dashed green = pull / return path · red = refusal As of 2026-09-30 09:41 UTC, from commit 5e47310

Provenance

This drawing is generated, not drawn. It is rebuilt from the source files below, so when they change the picture changes — a diagram here cannot quietly describe a system that no longer works this way.

Owner
Kevin
Slug
credential-vault
Rendered
2026-09-30T094150Z
From commit
5e473105f4
Updated
30 Sep 2026, 09:41 UTC
Sources at
5e47310
Watches
5 paths
  • daemon/src/sealed_vault.py
  • daemon/src/bootstrap_vault.py
  • daemon/src/key_vault.py
  • daemon/config/vault-template.yaml
  • daemon/docs/standards/CREDENTIAL_VAULT.md