COO-area chats: secrets tooling runs as TSGCOO Linux account

TSGCOO (docker group) operates the vault via /data2/TSGCOO/.local/bin/sm;
reachableceo crosses over with sudo -u TSGCOO (NOPASSWD, sudoers.d).
Ticket: https://projects.knownelement.com/issues/829

agents/global/AGENTS.md

@@ -29,10 +29,11 @@ question (see Questions). Effective 2026-08-31.
 ## Hard rules
 
 - ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578).
-- Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material.
+- Secrets: ONE place — the TSGCOO Bitwarden vault, accessed ONLY via the KNELSecretsManager Go CLI (`sm`, container ukrrs-secretsmgr-cli). RULING 2026-09-06: the legacy ~/.creds textfile pattern is RETIRED and ARCHIVED (/root/knel-creds-archive-20260906.zip, 400) — no new textfile creds, no upstream Rust bw CLI. NEVER in repos, images, compose files, app databases, logs, or error strings.
+- COO-area chats run secrets tooling AS the TSGCOO Linux account (/data2/TSGCOO, docker group — no sudo; cross-over: `sudo -u TSGCOO`, NOPASSWD). Entry: /data2/TSGCOO/.local/bin/sm. Ruling 2026-09-06.
 - Host hygiene (ruling 2026-08-31, RETIRES the old curl ban): common shell commands on the host are fine, curl included. NOT fine: package installs on the host (apt-get/pip/etc) or piling work/toolchains onto it — ALL work runs in containers (python inside dev/build containers is fine). Keep the host a thin, clean layer.
 - Missing CLI on the host? DOCKER PULL IT (ruling 2026-08-31, standing permission): agents may pull tooling images freely — anything that makes the work easier (jq, ripgrep, etc. already fine from host; grab whatever else via `docker run --rm <pinned-or-digest image>`). No permission needed; never apt/pip instead.
-- New gitea repos default to PUBLIC (ruling 2026-08-31): create with `--private=false`; go private only when the human asks or the content demands it (secrets are never repo content anyway — ~/.creds is the only home for those).
+- New gitea repos default to PUBLIC (ruling 2026-08-31): create with `--private=false`; go private only when the human asks or the content demands it (secrets are never repo content anyway — the Bitwarden vault (via `sm`) is the only home for those).
 - NO Python from agents, ever (ruling 2026-08-31, human preference): ALL text/JSON/CSV processing = bash, sed, awk, perl, cut, jq, sort/uniq. Never python one-liners; HTTP = curl. Same rule for anything you hand the human: shell only.
 - 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`.
 - Image tags: digests or pinned versions, NEVER :latest.
@@ -115,5 +116,5 @@ question (see Questions). Effective 2026-08-31.
 
 - All LLM traffic flows through the gateway (z.ai plan is the shared, metered budget: demand shaping is fleet-wide; per-request policy ladder normal -> peak -> cooldown -> hard; /status publishes the signal).
 - There are NO per-key quotas; never mint credentials. Identity is platform-level; X-Consumer is attribution only.
-- Master key stays env-only (~/.creds/gateway.env), ops/bootstrap only.
+- Master key stays vault-only (KNELSecretsManager `sm`), ops/bootstrap only.
 - Gateway repo work follows its own promote.sh pipeline; see tiers above.