docs(secrets): Infisical folder paths are project-relative (BUNYIP-530) #528

Merged

nrupard merged 1 commit from docs/BUNYIP-529-secret-path-runtime into main

2026-08-12 22:00:48 +02:00

nrupard commented

2026-08-12 21:52:17 +02:00

Owner

Infisical scopes one project plus one machine identity per app, so folder paths carry no /<app> prefix (the app is already implied). Corrects the Group-2 folder to /runtime across the bunyip docs and code comments, and fixes the 404 troubleshooting.

Changes

docs/secrets-infisical.md: folder tree + all Group-2 references to /runtime; the machine-identity note explains the project-relative convention; the 404 troubleshooting row now gives the real diagnosis (a lookup mismatch at project/env/path), not the disproven v3-vs-v4 guess.
crates/bunyip-domain/src/services/infisical.rs: the endpoint doc-comment (v3 confirmed on infisical.a8n.systems, 401 unauthenticated) plus the test fixture secret_path to /runtime.
crates/bunyip-domain/src/config.rs: the INFISICAL_SECRET_PATH doc-comment example to /runtime.
README.md, docs/e2e.md: /bunyip/runtime to /runtime.

Root cause

The c-01 fetch 404'd. Verified the v3 endpoint is fine (401 unauthenticated on infisical.a8n.systems), so the secret was simply not at /bunyip/runtime; it lives at /runtime because the machine identity is project-scoped. The c-01 config fix is docker PR #349.

Follow-up

Group-1 sync (/bunyip/app) and E2E (/bunyip/e2e) still carry the prefix in live config (sync-secrets.nu + the seeded secrets). Aligning them needs a coordinated secret-move and is tracked in BUNYIP-530. Companion updates: governance INFISICAL.md and KB DEV-A-44.

Infisical scopes one project plus one machine identity per app, so folder paths carry no `/<app>` prefix (the app is already implied). Corrects the Group-2 folder to `/runtime` across the bunyip docs and code comments, and fixes the 404 troubleshooting. ## Changes - `docs/secrets-infisical.md`: folder tree + all Group-2 references to `/runtime`; the machine-identity note explains the project-relative convention; the 404 troubleshooting row now gives the real diagnosis (a lookup mismatch at project/env/path), not the disproven v3-vs-v4 guess. - `crates/bunyip-domain/src/services/infisical.rs`: the endpoint doc-comment (v3 confirmed on infisical.a8n.systems, 401 unauthenticated) plus the test fixture `secret_path` to `/runtime`. - `crates/bunyip-domain/src/config.rs`: the `INFISICAL_SECRET_PATH` doc-comment example to `/runtime`. - `README.md`, `docs/e2e.md`: `/bunyip/runtime` to `/runtime`. ## Root cause The c-01 fetch 404'd. Verified the v3 endpoint is fine (401 unauthenticated on infisical.a8n.systems), so the secret was simply not at `/bunyip/runtime`; it lives at `/runtime` because the machine identity is project-scoped. The c-01 config fix is docker PR #349. ## Follow-up Group-1 sync (`/bunyip/app`) and E2E (`/bunyip/e2e`) still carry the prefix in live config (`sync-secrets.nu` + the seeded secrets). Aligning them needs a coordinated secret-move and is tracked in BUNYIP-530. Companion updates: governance `INFISICAL.md` and KB DEV-A-44.

nrupard added 1 commit

2026-08-12 21:52:17 +02:00

docs(secrets): Infisical folder paths are project-relative (/runtime, not /bunyip/runtime)

E2E / PR gate (pull_request) Successful in 24s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 4m45s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

cdf8f01433

Infisical scopes one project + machine identity per app, so folder paths carry no /<app> prefix. Correct the Group-2 folder to /runtime across the bunyip docs and the infisical.rs / config.rs comments, and fix the 404 troubleshooting to the real diagnosis (a lookup mismatch at project/env/path, not an API v3-vs-v4 problem; v3 is confirmed on infisical.a8n.systems). The infisical.rs test fixture uses /runtime. Group-1 sync (/bunyip/app) and E2E (/bunyip/e2e) still carry the prefix in live config; migrating them is tracked separately.

#BUNYIP-530

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>