docs(components): normalize Secrets component + index the shared lib

Add components/secrets/ (SPEC, realized shared-contract, code-verified current-state for OtOpcUa/mxaccessgw/ScadaBridge, GAPS adoption backlog) and register the Secrets row in CLAUDE.md + components/README.md. The ZB.MOM.WW.Secrets lib is built + published 0.1.2 + reference-consumer-proven (HistorianGateway, live vs the wonder historian); per-app adoption is the tracked follow-on.
2026-07-16 04:49:57 -04:00
parent de77bc30e3
commit e347286f28
9 changed files with 474 additions and 0 deletions
@@ -0,0 +1,38 @@
+# Secrets (encrypted secret store + `${secret:}` resolution)
+
+Normalizes how the family stores and consumes secrets — SQL/login passwords, API-key HMAC
+peppers, LDAP bind passwords, connection strings, TLS material — which are handled ad-hoc
+and inconsistently across the three apps today (Data-Protection-encrypted connection
+strings in ScadaBridge; peppers/passwords in environment variables; LDAP passwords in
+`appsettings`).
+
+The goal is the shared **`ZB.MOM.WW.Secrets`** library: AES-256-GCM envelope encryption at
+rest, a pluggable master-key provider and store, an audited `ISecretResolver` +
+`${secret:name}` config expander for app runtime, and a Blazor `/admin/secrets` management
+UI. The library is **built, published (0.1.2), and live-proven** via its reference consumer;
+per-app adoption is the tracked follow-on.
+
+- **Target:** [`spec/SPEC.md`](spec/SPEC.md)
+- **Realized API:** [`shared-contract/ZB.MOM.WW.Secrets.md`](shared-contract/ZB.MOM.WW.Secrets.md)
+- **Implementation:** [`../../ZB.MOM.WW.Secrets/`](../../ZB.MOM.WW.Secrets/) · design [`docs/plans/2026-07-15-secrets-manager-design.md`](../../docs/plans/2026-07-15-secrets-manager-design.md)
+- **Adoption backlog:** [`GAPS.md`](GAPS.md)
+
+## Status
+
+| | State |
+|---|---|
+| Library | **Built + published** — `ZB.MOM.WW.Secrets{,.Abstractions,.Ui}` 0.1.2 on the `dohertj2-gitea` feed; `.Cli` in-repo (not packed); `.Akka` replicator **deferred** (design only) |
+| Reference consumer | **HistorianGateway — adopted + live-proven** (2026-07-16): historian password sourced via `${secret:}`, authenticated read against the real wonder historian |
+| Three sister apps | **Not yet adopted** — see per-app current-state + GAPS |
+
+## Per-project current state
+
+| Project | Today (baseline) | Doc |
+|---|---|---|
+| OtOpcUa | _(code-verified baseline)_ | [`current-state/otopcua/CURRENT-STATE.md`](current-state/otopcua/CURRENT-STATE.md) |
+| MxAccessGateway | _(code-verified baseline)_ | [`current-state/mxaccessgw/CURRENT-STATE.md`](current-state/mxaccessgw/CURRENT-STATE.md) |
+| ScadaBridge | _(code-verified baseline)_ | [`current-state/scadabridge/CURRENT-STATE.md`](current-state/scadabridge/CURRENT-STATE.md) |
+
+> Not applicable as a fourth adopter row but the exemplar: **HistorianGateway** already
+> consumes the lib — its wiring is the template the three apps follow (see the
+> shared-contract "Consumer wiring" section).