hosting-kv-copy: materialise a fleet-shared vault object under an instance's prefix (Plugins#1723) by rbuergi · Pull Request #4103 · Systemorph/MeshWeaver

rbuergi · 2026-09-12T14:20:20Z

Operator half of MeshWeaver.Plugins#1723 (the plan half — keyVaultSecrets.secrets[].copyFrom → a "Copy fleet-shared secrets" step — is the paired Plugins PR; Pairs-with: none — this PR removes no public surface).

The hand step it replaces

Memex docs/new-deployment.md has no step for it — it was done ad hoc for build on 2026-09-12 (build.json notes):

build-GitHub-App-PrivateKey — a byte-identical COPY (sha256-verified) of memexsystemorph-GitHub-App-PrivateKey, made 2026-09-12 by piping az keyvault secret show into az keyvault secret set --file /dev/stdin

The Memex PR at the end of this series adds it to the runbook as "done by Provision since Plugins#1723".

What changes

New command hosting-kv-copy --vault <v> --copy <target>=<source> […]:

absent target → source read into a variable, written through a mode-600 --file (never argv), read back by id; ::hosting:: kv_copy_created=n;
existing target → KEPT, never rewritten (the master-key rule); compared with the source by sha256 and a difference is reported as kv_copy_drift=n — a fact for the operator, not a failure;
no value is ever printed; every pair is gated before the vault is touched; every refusal names the exact hand command; dry run reads no value.

Why a copy at all: hosting-kv-purge deletes by PREFIX on teardown, so a cross-prefix mapping would let the first teardown take the fleet's shared PEM with it. The copy makes the object the instance's own, purged with it.

Rights the operator identity needs

Key Vault secret get on the source object and set on the target — both under the existing Key Vault Secrets Officer grant on Systemorph. Nothing new.

Gates run

$ bash deploy/aks/operator/test/run-tests.sh
319 passed, 0 failed          (291 on main; +28 new hosting-kv-copy cases)
$ shellcheck -S warning deploy/aks/operator/bin/hosting-* deploy/aks/operator/test/stubs/kv-copy/az
(clean)

hosting-operator.yml: hosting-kv-copy added to the plan-command list, tracked-file floor raised to 26 (measured on the tree merged with main 8aaf35f: 23 commands + run.sh + _common.sh + _audit.jq; main is at 25), stub added to the tracked-stub list.

Ships how

Hop (C): published as hosting-operator:<sha> on the merge to main; reaches a Provision when operator.image on Deployments/memex moves. Merging is not shipping.

🤖 Generated with Claude Code

…tance's prefix (MeshWeaver.Plugins#1723) The fleet GitHub App's private key existed only under the control instance's prefix (memexsystemorph-GitHub-App-PrivateKey); the build instance maps it as build-GitHub-App-PrivateKey, and the copy was a hand step (az show | az set --file /dev/stdin). The copy is needed because hosting-kv-purge deletes by PREFIX on teardown — mapping across prefixes would let the first teardown take the shared PEM. hosting-kv-copy --vault V --copy <target>=<source> [...]: an absent target is copied from its source through a mode-600 --file (never argv), read back by id; an existing target is KEPT — never rewritten — and compared with its source by sha256, a difference reported as ::hosting:: kv_copy_drift (a fact, not a failure). No value is ever printed. Every pair is validated before the vault is touched; every refusal names the exact hand command. The plan half (keyVaultSecrets.secrets[].copyFrom → one step after the vault step) is the paired MeshWeaver.Plugins PR. hosting-operator.yml: plan list + tracked-file floor (24) + stub list. Tests: 28 behaviour cases against a recorded-argv az stub (test/stubs/kv-copy/az). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

🟡 Changes recommended

Unresolved critical and moderate correctness and safety issues remain in the copy command.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds hosting-kv-copy to materialize fleet-shared Key Vault secrets under instance-specific prefixes while preserving existing targets.

Changes:

Adds copy, keep/drift, hashing, and dry-run behavior.
Adds tests and an Azure CLI stub.
Updates lifecycle documentation and CI tracking.

File summaries

File	Summary
`deploy/aks/operator/test/stubs/kv-copy/az`	Azure CLI test stub; moderate concern that whitespace splitting prevents byte-preserving and trailing-newline coverage.
`deploy/aks/operator/test/run-tests.sh`	Adds command behavior and safety tests.
`deploy/aks/operator/bin/hosting-kv-copy`	Implements copying; findings include critical source-read, byte-preservation, and write-error handling issues; moderate argument and target-read handling issues; and a nit in the refusal message.
`deploy/aks/INSTANCE-LIFECYCLE.md`	Documents the lifecycle behavior.
`.github/workflows/hosting-operator.yml`	Adds CI integration; moderate issue that the tracked-file floor and diagnostic should be 25 rather than 24.

Review details

Suppressed comments (1)

deploy/aks/operator/test/stubs/kv-copy/az:16

Because this expands HOSTING_KVC_VALUES unquoted, the stub splits on whitespace and cannot represent the multiline/trailing-newline PEM this command is meant to copy. The new “byte-for-byte” test therefore only exercises a one-line token and will not catch the -o tsv truncation; use a representation that preserves arbitrary secret bytes and add a trailing-newline case.

  for pair in ${HOSTING_KVC_VALUES:-}; do
    if [ "${pair%%=*}" = "$1" ]; then printf '%s' "${pair#*=}"; return 0; fi

Files reviewed: 4/5 changed files
Comments generated: 1
Review effort level: Lite

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-12T14:40:35Z