vercel-env-puller

The hardest part of Wave 5. AFK Sandcastle agents need real production secrets to call real DBs / real Anthropic / real Stripe. The manifest design enforces four invariants so secrets never accumulate where they can leak.

Why this exists

The Wave 5 recon (Phase 1, this session) found 80+ unique env vars across 9 portfolio projects. Naive injection would let a single Sandcastle run see every secret in process.env. That violates least-privilege and creates a single exfiltration path.

This skill enforces:

1. Pi-CEO must not log secrets — manifests store names only; stdout from Sandcastle is regex-stripped before reaching session.logs.
2. Pi-CEO must not write secrets to disk — Sandcastle config file lives on tmpfs (Linux /dev/shm) or named pipe (macOS mkfifo); always unlinked in finally.
3. ANTHROPIC_API_KEY rotation must not silently break 7 projects — auth-failure pattern detection emits cfo_alert; manifest criticality:blocker flag triggers escalation lock.
4. Per-project secrets must not leak across project sandboxes — each Sandcastle run receives ONLY the resolved env dict for the target repo.

Manifest format

Pi-Dev-Ops/.harness/env-manifests/{project-slug}.json: