---
name: inject-admin-secrets
description: "Bootstrap or rotate the encrypted Admin escrow used by automatic Admin deployments, with an explicit disaster-recovery target flow."
visibility: public
allowed-tools:
  - Read
  - Bash
---

# Inject Admin Secrets

Use this skill for the one-time canonical Admin escrow bootstrap, deliberate
rotation, or disaster recovery. Normal Admin creation, start, deploy, and
Machine replacement restore automatically from the active encrypted generation;
do not run a host-side target injection for those operations.

Run:

`node "{{adminRoot}}/scripts/inject-admin-secrets.mjs" --json`

Use `--dry-run` for the no-transport gate rehearsal. The command authenticates
automatically from the canonical private Admin profile's Sellable token and
configured workspace context; do not supply or print a bearer. It reads the two
private profile documents needed for operator authentication, reads zero
transport-bundle files, constructs no settings payload, seals nothing, and
writes nothing to a target. The redacted receipt reports these separately as
`operatorAuthentication.credentialFilesRead` and `secretsRead`. With no active
generation, the normal command explicitly confirms and bootstraps one. With an
active generation, it reports that generation without constructing or sealing
the source bundle. Use `--rotate` only for a deliberate fenced successor.

Lightfield is not part of Admin escrow or the Hermes MCP inventory. It is a
workspace-managed Product integration connected in Sellable, where Sellable
validates and encrypts the API key without copying it into the Agent runtime.
Admin profiles use the Product MCP managed integration through
`integrations_list_tools`, `integrations_describe_tool`, and
`integrations_call_tool`. Never add a direct `lightfield` MCP alias, an OAuth
cache, or the Lightfield API key to Admin settings, escrow, receipts, logs,
packages, image layers, or profile files.

The only settings source is the canonical private Admin home. Never use the
current repository directory as a fallback. The closed inventory is `.env`,
`settings.json`, and `config-state.json`. Google files and Google readiness are
outside this workflow; Gmail is provided by the product's Pipedream
integration. Never inherit a root/dashboard Hermes home or use repository-root
configuration. Grain reads use the injected profile's packaged
`<adminHome>/bin/grain` runtime and its `settings.json` workspace token.

Bootstrap seals the closed bundle to the control plane's recovery public key
and uploads ciphertext only. New eligible Admin Machines then attest their
target X25519 keys and receive an automatic Machine-bound delivery through the
normal backend capability/import/cleanup path. Report only redacted escrow and
target receipts; the command's durable output is always a redacted receipt.

Use `--disaster-recovery` only when the active escrow path is unavailable and
the operator has deliberately chosen from the current backend-approved targets.
That recovery flow re-lists before delivery, requires explicit selection and
explicit confirmation, seals to the selected Admin Machine's workload-attested
X25519 key, waits for cleanup, and verifies exactly the two core packaged MCPs,
`sellable` and `sellable-admin`. There is no manual target, Customer override,
direct server-copy, GitHub Secrets, or detached-profile path.