[groupsky]

Refs #127

An infisical store: the broker logs in with a machine identity (Universal Auth) and reads one secret, with the official Infisical Go SDK (the owner's choice).

Progress

• Store type = "infisical": config (server, client_id, client_secret_file), secret (project, environment, path, name)
• Log in, keep the access token only in memory, log in again before the TTL ends, or once after a 401
• Tests with a fake server: wrong project, missing secret, empty value, refused login, ended token, time-out, too-large answer, a ${...} value (refused)
• Canary test: client secret and access token in no log, error or audit entry
• docs/setup.md sections 5, 9, 13
• DESIGN.md sections 4, 14, 16, 17; THREAT-MODEL.md sections 2, 3, T18, T29, new threat T41 (project members read with no tap); manual test check 17 in docs/manual-telegram-test.md
• Binary size before and after, new modules (below)
• Security review of the whole PR: no critical or high findings; the 2 low ones (a wrong code comment, a note in T18 on Go strings) are fixed
• Manual test with a real machine identity (needs Geno)

Choices

• How the SDK is used. The SDK's client takes no http.Client, its calls take no context, it reads the client ID and secret from environment variables when they are empty, and it logs to stderr. So the store calls the SDK's exported request functions (CallUniversalAuthLogin, CallRetrieveSecretV3) with its own resty client: no retries, no redirects, no log, no cache, no refresh goroutine, the call's context on each request, and a cap of 1 MiB on each answer.
• path is required, with no default: a default / could quietly pick a secret of the same name in another folder.
• A value with ${ is refused (open question 3): the tap must show every secret that goes out. Reads ask Infisical not to expand references and not to include imports.
• Re-login: before the token's TTL ends (10 s margin), or once after a 401 on a kept token. A 403 denies at once.
• Open question 2 (rate limits of the free plan): a 429 is a fixed rate-limit error and the broker's alert names the store. No other handling.

Cost of the SDK (new dependencies)

• Binary (go build -trimpath -ldflags="-s -w"): 26,727,592 bytes before, 32,704,712 after (+22.4 %, with gRPC v1.83.1).
• Direct: github.com/infisical/go-sdk v0.9.1, github.com/go-resty/resty/v2 v2.13.1. Indirect: 42 more in go.mod (the AWS SDK, GCP auth and IAM, gRPC, OpenTelemetry, oauth2, zerolog, golang-lru and others) — the SDK's packages/util pulls them in even for the two calls nodkey uses.
• The SDK pulls in gRPC v1.79.3, which govulncheck flags (GO-2026-6348, GO-2026-6061). This PR raises gRPC to v1.83.1, the fixed version.
• The SDK needs Go 1.26.10, so the go line moves from 1.26.0 to 1.26.10.
• Reason: the owner chose the official SDK (feat: Infisical as a store (a read-only machine identity) #127, 2026-10-29). The issue's fallback, our own ~60 lines of HTTP code as for Telegram, would drop all of this; that is the owner's call.

Tests: go test -race ./... and go vet pass on Go 1.27 with CI=true; the new tests pass with -count=20 -cpu 1,2,4. Go 1.26.0 cannot build the module any more (go.mod needs 1.26.10); CI takes Go from go.mod.

Known limit: the value stays in resty's answer buffer until the garbage collector frees it; Go cannot clear it.

🤖 Generated with Claude Code