What problem does it solve? Agents lose their machines — containers get reclaimed, hosts are rebuilt, sessions resume on fresh hardware — and their credentials cannot sit in a shared object store in the clear. This Skill defines how to seal credentials into encrypted bundles, recover them on a successor machine with one passphrase, and verify each secret actually authenticates before relying on it. ## Core Features & Use Cases - Sealed bundle format: A versioned JSON envelope using ChaCha20-Poly1305 with a random DEK per version, scrypt-derived KEK wraps, and length-prefixed AAD binding the ciphertext to its role and version. - Re-entrancy probes: An ordered five-probe sequence (pointer, object, envelope, unlock, verify) that tells a successor session exactly where to enter the recovery workflow. - Per-secret verification: Each secret carries its own verifier inside the sealed payload, reporting VERIFIED, FAILED, or UNKNOWN — where UNKNOWN is never treated as success. - Use Case: A successor agent resumes on a rebuilt host, reads its role charter for the bundle pointer, runs the unlock command with the operator passphrase, and learns that 2 of 3 credentials still authenticate and one must be rotated before use. ## Quick Start Ask the agent to run the secrets unlock command for your role, enter the operator passphrase at the prompt, and review the per-secret verification table before relying on any credential.
