SOPS Add Key

Add a new machine's age public key to the project and re-encrypt all files so the new machine can decrypt them.

Workflow

1. Detect current state:

   python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>
   

2. Verify prerequisites:

   • project.sops_yaml.exists must be true — if not, tell user to run /devtools:sops-setup first
   • project.encrypted_files should be non-empty — warn if there are no .enc.yaml files to re-encrypt
   • If project.tmp_files is non-empty, warn about stale temporary files (leftover from a failed decrypt/re-encrypt) and suggest the user delete them

3. Audit key propagation (if encrypted files exist): For each encrypted file, read its YAML and check the sops.age recipients list against project.sops_yaml.authorized_keys. If any authorized key is missing from any file's recipients: