Secret provisioning

Create one file per secret under the deployed ${SECRETS_DIR} with mode 0600 and an owner readable only by the intended deployment operator. Do not commit the directory or copy its contents into evidence.

Required core secrets:

postgres_superuser_password
hub_database_password
contextforge_database_password
contextforge_auth_encryption_secret
contextforge_jwt_secret
contextforge_admin_credential
contextforge_api_token (generated by the controlled ContextForge bootstrap)
stitch_api_key (Google Stitch API key; connector-only, never exposed to MCP clients)
authentik_oidc_client_secret
hub_session_signing_key

contextforge_api_token is absent during the initial predeploy check. Generate it with scripts/contextforge_bootstrap.py after ContextForge is healthy and scope it to the bootstrap's explicit gateway, tool, prompt and virtual-server permissions. Rotate an older token when the required permission set changes, then start the Hub services; the poststart preflight requires it.

Optional connector secrets are added only when that connector is enabled. Use least-privilege, read-only credentials in v1.0.

The application may show whether a secret reference is configured and when it was last verified. It must never show, return, audit, or log the value.