cx-platform-secrets

Why reach for it

A credential's value has exactly one place to be, and it is not your program. cx-platform-secrets is the minimal keystore: programs, feature documents, deployment documents and audit records carry a handle, handle:<provider>/<path>, and the value exists only inside this module's resolve seam and the one operation a consuming module hands it to. Everything that can reach a value is in this one repository, which is a boundary you can inspect, fork or replace.

What the operation receives is a secret: it computes — equal to the value it was resolved from, in constant time, unequal to any other — and it renders as ‹redacted› at every emit boundary, so a log line, a canonical form or an error message cannot carry it out. A consumer the deployment's authorization rows do not grant is refused and nothing resolves; a malformed handle, an unbound provider and an absent value each refuse with their own code, in a fixed order the corpus pins.

Every resolution — granted or refused — writes one audit record naming the consuming module and the handle, never the value, through the store's audit stream. Custody rises by a provider row: an env provider boots a development keystore and is refused in a served profile, a sealed store keeps values under AES-GCM beneath a master key file the keystore insists is mode 0600, rotation answers the active value inside its window and the successor after it, and a provider kind that could export a value is refused at boot. The cx secrets verbs stay in the front door's binary, because the binary is the front door's to build.

What it gives you

One module of the platform group, a pure-CX package with no V code: open, with-resolved, the sealed store's put, rotate and list, and nothing that answers a value. It links to the reference page projected from its own documentation.

Try it

A keystore booted over an in-memory audit journal with one env provider, and a granted consumer handed the secret: emitted, it is the redaction marker; compared, it is equal to the value it came from and unequal to anything else. The env grant is the provider's, not the program's.

        [?lib 'cx-platform/secrets']
[?lib 'cx-platform/audit']
[?lib 'cx-platform/journal']
[?let [= $u [$audit:unbind]]
      [= $j [$journal:open "mem://s003" "dev"]]
      [= $b [$audit:bind $j {tenant: "dev"}]]
      [= $ks [$secrets:open [deployment name=dev
               [runtime
                [secrets [provider name=os kind=env]]
                [authz tenant=dev
                  [delegation d-dev [tenant dev] [from [principal operator]] [to [module 'cx-platform/connector']]
                    [capabilities [secrets:resolve]] [over 'handle:os'] [assurance :t1] [signature s]]]]]]]
  [$secrets:with-resolved $ks 'handle:os/home' 'cx-platform/connector'
    [?fn ($s) [probe [emitted [$format:canonical [box $s]]]
                     [equal [= $s [?secret [$env:var 'HOME']]]]
                     [unequal [= $s [?secret 'not-the-home-directory']]]]]
    {now: '2026-09-26T09:00:00Z'}]]
      

        $ cx --allow-env prog.cx
[probe [emitted "[box '‹redacted›']"] [equal true] [unequal false]]
      

Status

The keystore ships as a package: its one module is bundled into the build from the pin, its specification and corpus travel with it, and the connector kit resolves a gateway's credential through its seam at open.

Links

• github.com/cx-home/cx-platform-secrets — the repository
• README — what it is, how to install it, what it pins
• spec/03-approved — the specification, the only truth
• spec/03-approved/platform — the specification, the only truth
• conformance — the conformance corpus, the executable truth
• conformance/platform — the conformance corpus, the executable truth