Context

PR #16663 by @amor71 delivers GCP, AWS, Azure, and Vault secret providers with CLI tooling, per-agent IAM isolation, stale-while-revalidate caching, migration scripts, and 130+ tests.

Our PR #11539 had a SecretsProvider interface and implementations for env vars and OS keyring. We closed it and are building on top of their work.

Plan

1. ✅ Port env provider — resolves secrets from environment variables (with optional prefix, hyphen-to-underscore mapping)
2. ✅ Port keyring provider — OS-native credential storage (macOS security CLI, Linux secret-tool/libsecret)
3. ✅ Add 1Password provider — uses op CLI (op read op://vault/item/field), supports service account tokens for CI
4. ✅ Register all three in buildSecretProviders()
5. 🔄 Review + fix cycle — in progress
6. ⬜ Docs

Division of Labor

Depends On

• feat: GCP Secret Manager integration for external secrets management #16663 (must land first)

References

• feat: pluggable secrets manager integration ($secret{NAME} syntax) #11539 (our original PR, closed)
• Add native secrets management integration (AWS Secrets Manager, Vault, etc.) #13610 (original GCP secrets issue)