fix(secrets): the lab's sops rule matched nothing, so it used the estate's key

[Gerrrt]

Found by following build-the-lab-guest.md on alexander: make secrets-edit STACK=lab fails with sops' no identity matched any of the recipients.

What actually happened

ADR-0020 gave stacks/lab its own creation_rule above the catch-all, because that catch-all matches all of secrets/ — a recipient added there can decrypt the estate's SNMP communities and Grafana admin password.

The rule shipped as:

path_regex: secrets/lab\..*\.sops\.ya?ml$

which cannot match secrets/lab.sops.yaml. After secrets/lab\. consumes the only dot before sops, \.sops\. has no second dot left to match — it would have matched secrets/lab.something.sops.yaml and nothing else.

So the rule matched nothing, sops fell through to the catch-all, and make secrets-init STACK=lab on the guest encrypted the lab's secrets to the estate's key — doing precisely what the rule was added to prevent, and reporting success while it did.

bootstrap.sh's refusal did not help: it guards against writing one key into two rules, and the failure was a layer below that, in which rule sops picked.

Why nothing caught it

sops does not warn about a creation_rule that matches no file. It silently uses the next one. The separation existed in the file, was reviewed, was merged, and was not real. It surfaced days later on a machine you have to walk to, as an error naming the symptom and not the cause.

Blast radius

Small, and worth stating precisely:

• secrets/lab.sops.yaml was never committed — no bad ciphertext in the repository.
• The file holds only secrets/lab.example.yaml's placeholder values. Nothing real was encrypted to the wrong key.
• The estate's own secrets are untouched.
• One untracked file on one host, which the runbook now tells you to delete.

The guard

scripts/check_sops_rules.py, wired into make validate and CI. Its central assertion is the one that would have caught this: every creation_rule must match at least one file this repository actually encrypts. A rule matching nothing is a typo or dead, and both are indistinguishable from working until the fall-through matters.

It also prints the resolution, so the separation is visible rather than inferred from two regexes:

.sops.yaml OK — 2 creation_rule(s), each matching:
  secrets/lab.sops.yaml -> secrets/lab(\..+)?\.sops\.ya?ml$
  secrets/observability.sops.yaml -> (secrets/.*|backups/firewall/.*)\.sops\.ya?ml$
  backups/firewall/config-20260101T000000Z.sops.yaml -> (secrets/.*|backups/firewall/.*)\.sops\.ya?ml$

Paths are derived — stacks from scripts/stacks.sh, the firewall path from the shape backup-firewall.sh writes — rather than a fourth hand-kept list.

Verified by putting the broken pattern back, not by reading the fix: the check fails and names the dead rule.

Also

The runbook gains a recovery callout at §4, since anyone following it hits this. make validate passes.

🤖 Generated with Claude Code