Give the pairing vault its own key, and let the gate build the assets

Two deploy blockers that both cost a full gate run to discover.

The pairing vault has run on the GitHub vault's key in production since
#192 shipped. That fix was correct and deployed; it left a bridge in
runtime.exs so the deploy introducing MACHINE_TOKEN_ENCRYPTION_KEY would
boot before an operator provisioned the secret, and the bridge that was
meant to last one deploy became the configuration. VAULT-001 says each
vault seals under its own key and two of the three did not. The secret is
provisioned and readable by the fleet runtime account; this wires it in, so
the separation deploys with the next roll. The vault's decrypt-side
fallback keeps the at-most-ten-minute pairing population readable across
the switch.

The gate installs the asset dependencies before it starts. A release
worktree is created fresh and assets/node_modules is untracked, so
mix esbuild failed to resolve an import eight stages in and reported a
missing npm package as a deploy blocker. This has cost four gate runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed

by user · WAL seq 399 · 2026-08-25T15:26:29.451797Z

Changed files

• modified ops/ci/gate.sh
• modified ops/deploy/fleet-startup.template.sh

Diff

2 files changed, +19 -0

  fi

done

# The asset dependencies. A release worktree is created fresh, `assets/node_modules`

# is not tracked, and nothing else in the gate installs it — so `mix esbuild`

# fails to resolve an import eight stages in and reports a missing package as a

# deploy blocker. Installed here, before any stage, because a gate that cannot

# build the assets has not tested the release.

if [ ! -d "$repo_root/assets/node_modules" ]; then

  echo "Installing asset dependencies"

  (cd "$repo_root/assets" && npm ci --no-audit --no-fund) || {

    echo "asset dependencies could not be installed" >&2

    exit 1

  }

fi

run_root=$(mktemp -d /tmp/openagents-release-gate.XXXXXX)

started_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)

started_epoch=$(date +%s)

export GITHUB_CLIENT_SECRET="$(secret sarah-production-github-client-secret)"

export GITHUB_TOKEN_ENCRYPTION_KEY="$(secret sarah-production-github-token-encryption-key-reserved)"

export VOICE_RECORDING_ENCRYPTION_KEY="$(secret sarah-production-voice-recording-key)"

# The pairing vault's own key (VAULT-001, issues #192 and #253). Until this

# was set, runtime.exs bridged the pairing vault to the GitHub vault's key,

# so two vaults sealed under one key and a GitHub rotation silently moved

# the pairing vault too. The bridge was meant to last one deploy.

export MACHINE_TOKEN_ENCRYPTION_KEY="$(secret openagents-machine-token-encryption-key)"

export RELEASE_COOKIE="$(secret sarah-release-cookie)"

export OPENAGENTS_FORGE_OPERATOR_TOKEN="$(secret sarah-forge-operator-token)"

export OPENAGENTS_POSTHOG_PROJECT_TOKEN="$(secret openagents-posthog-project-token)"

  AI_GATEWAY_API_KEY

  GITHUB_CLIENT_ID GITHUB_CLIENT_SECRET

  GITHUB_TOKEN_ENCRYPTION_KEY VOICE_RECORDING_ENCRYPTION_KEY RELEASE_COOKIE

  MACHINE_TOKEN_ENCRYPTION_KEY

  OPENAGENTS_FORGE_OPERATOR_TOKEN OPENAGENTS_POSTHOG_PROJECT_TOKEN

  DATABASE_URL DNS_CLUSTER_QUERY

  GITHUB_OAUTH_SCOPES GITHUB_REDIRECT_URI GITHUB_TOKEN_DECRYPTION_KEYS_JSON