feat(P01): SLICE-05 operator bootstrap CLI + secrets scope
- TASK-05-01 scripts/create-operator.py: CLI that reads
PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS + PRAXIS_PG_DSN from env, creates
the pool, applies migrations, hashes the password with argon2id, and
INSERTs with ON CONFLICT DO NOTHING (idempotent — D-052). --update
flag forces rehash + ON CONFLICT DO UPDATE. Missing env → exit 1
(R-BOOT-02). Connection failure → 3x retry with 5s backoff (R-BOOT-01).
- TASK-05-02 .ciagent/config.json: added "operator" secrets scope
(PRAXIS_PG_PASSWORD, PRAXIS_COOKIE_SECRET,
PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS, PRAXIS_VC_ISSUER_KEY).
.ciagent/.env.secrets.example: template (committed, no real secrets).
.gitignore: added negations so .env.secrets.example is tracked while
.env.secrets stays ignored.
- TASK-05-03 tests/test_create_operator.py: 7 tests (mocked PgStore) —
create, already-exists (no update), --update rehashes, missing env →
exit 1, password is argon2id (not plaintext).
---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: devops-engineer
task: 05-01,05-02,05-03
requirements:
covered: [REQ-AUTH-01]
---/ci---
Praxis CI
e8a05adcd1