feat: define vault action TOML schema for PR-based approval #74

New issue

Closed

opened 2026-03-31 19:53:34 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-31 19:53:34 +00:00

Collaborator

Context

The new vault uses PRs on the ops repo as the approval mechanism. Each vault request is a TOML file describing what to run. This issue defines the schema.

Schema (proposed)

File: vault/actions/<action-id>.toml

# Required
id = "publish-skill-20260331"
formula = "clawhub-publish"      # formula name from formulas/
context = "SKILL.md bumped to 0.3.0"  # human-readable why

# Secrets to inject (only these get passed to the container)
secrets = ["CLAWHUB_TOKEN"]

# Optional
model = "sonnet"                  # override default model
tools = ["clawhub"]               # MCP tools to enable
timeout_minutes = 30               # max execution time

What to do

Document the TOML schema in a new vault/SCHEMA.md
Add a validation function in vault/vault-env.sh (or a new vault/validate.sh) that checks required fields, validates secret names against a known allowlist, and rejects unknown fields
Add 2-3 example TOML files in vault/examples/ (webhook-call, promote, publish)

Verification

vault/SCHEMA.md exists and documents all fields
Validation function rejects TOML with missing required fields
Validation function rejects unknown secret names
Example files pass validation

Dependencies

Depends on #73 (teardown) — old vault code removed first.

## Context The new vault uses PRs on the ops repo as the approval mechanism. Each vault request is a TOML file describing what to run. This issue defines the schema. ## Schema (proposed) File: `vault/actions/<action-id>.toml` ```toml # Required id = "publish-skill-20260331" formula = "clawhub-publish" # formula name from formulas/ context = "SKILL.md bumped to 0.3.0" # human-readable why # Secrets to inject (only these get passed to the container) secrets = ["CLAWHUB_TOKEN"] # Optional model = "sonnet" # override default model tools = ["clawhub"] # MCP tools to enable timeout_minutes = 30 # max execution time ``` ## What to do 1. Document the TOML schema in a new `vault/SCHEMA.md` 2. Add a validation function in `vault/vault-env.sh` (or a new `vault/validate.sh`) that checks required fields, validates secret names against a known allowlist, and rejects unknown fields 3. Add 2-3 example TOML files in `vault/examples/` (webhook-call, promote, publish) ## Verification - `vault/SCHEMA.md` exists and documents all fields - Validation function rejects TOML with missing required fields - Validation function rejects unknown secret names - Example files pass validation ## Dependencies Depends on #73 (teardown) — old vault code removed first.