Follow the trimmed required-secrets mechanism

Re-syncs the vendored engine and re-converges the scheduler workflow, which
now carries SCRAPER_API_KEY: ${{ secrets.SCRAPER_API_KEY }} stamped from the
two tasks' required_secrets declarations. Delivery is plain workflow env now
rather than a parsed bundle, so prose describing the old path is corrected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016NgBmWQmxLFPybrhSTz8i3

Author: claude

.claudinite/local/packs/gcec/RULES.md

@@ -155,10 +155,10 @@ on that pipeline). Adding a cached live case is the
   ScraperAPI's residential proxy (`render=true`, so a single-page app records
   post-render HTML with real data). Bot-blocking from CI/sandbox IPs is the
   portable rule maintained in the canon; here the escape hatch is the
-  `SCRAPER_API_KEY` **GitHub Actions secret**, which the scheduler unpacks into a
-  preprocessing worker's env — never a local fetch (this sandbox is bot-blocked),
-  and never an agent session (which holds no repo secrets). Both tasks name it in
-  `required_secrets`, which is how the owner gets asked to configure it. **Never re-introduce a workflow
+  `SCRAPER_API_KEY` **GitHub Actions secret**. Both tasks name it in
+  `required_secrets`, which is what puts it in the scheduler workflow's env (and
+  what gets the owner asked for it) — never a local fetch (this sandbox is
+  bot-blocked), and never an agent session (which holds no repo secrets). **Never re-introduce a workflow
   whose only job is to hold that secret for an agent**: `fetch-page.yml` was
   exactly that, and the dispatch/poll/pull round-trip it forced on the agent is
   what preprocessing removed. ScraperAPI is the whole fetching surface — swap the

.claudinite/local/packs/gcec/scraperapi.mjs

@@ -7,10 +7,11 @@
 // ScraperAPI underperforms, and both tasks follow.
 //
 // Only usable from a task's `agent_preprocessing` worker: it needs
-// SCRAPER_API_KEY, and the scheduler unpacks the repo's Actions secrets into a
-// worker's env — an executor session holds none. Both tasks name it in their
-// `required_secrets` so the owner is asked to configure it. This sandbox is
-// bot-blocked, so a direct fetch from a session would fail even with a key.
+// SCRAPER_API_KEY, which both tasks name in `required_secrets` — the wiring
+// converge stamps that into the scheduler workflow, so it reaches an Action-side
+// worker and nothing else (an executor session holds no repo secrets). This
+// sandbox is bot-blocked, so a direct fetch from a session would fail even with
+// a key.
 
 import { mkdirSync, writeFileSync, statSync } from 'node:fs';
 import { dirname } from 'node:path';

.claudinite/local/packs/gcec/tasks/create-extractor/prepare.mjs

@@ -16,10 +16,10 @@
 //      scaffold, prove the offline baseline green, and commit;
 //   4. RECORD THE PAGE through ScraperAPI directly. Preprocessing runs inside
 //      Actions, where SCRAPER_API_KEY already lives (the task names it in
-//      `required_secrets` so adoption asks the owner to configure it). The
-//      `fetch-page.yml` workflow existed solely to hold that secret for an agent
-//      that couldn't — dispatch, poll, pull. Deleted; this is one fetch in the
-//      same process that needs the bytes;
+//      `required_secrets`, which the wiring converge stamps into the workflow).
+//      The `fetch-page.yml` workflow existed solely to hold that secret for an
+//      agent that couldn't — dispatch, poll, pull. Deleted; this is one fetch in
+//      the same process that needs the bytes;
 //   5. push, open the DRAFT PR the agent continues on, and request the agent
 //      (CLAUDINITE_REQUEST_AGENT).
 //
@@ -229,9 +229,9 @@ export async function main() {
   TOKEN = process.env.GITHUB_TOKEN;
   const base = process.env.CLAUDINITE_DEFAULT_BRANCH || 'main';
   const requestFile = process.env.CLAUDINITE_REQUEST_AGENT;
-  // Named in task.mjs's `required_secrets`, so the owner has been asked to
-  // configure it (bootstrap at adoption, a standing issue from the scheduler
-  // otherwise). Nothing gates on that ask, so check it here and say so plainly.
+  // Named in task.mjs's `required_secrets`, so the wiring converge put it in this
+  // process's env and baselining has asked the owner for it if it isn't set.
+  // Nothing gates on that ask, so check it here and say so plainly.
   const scraperKey = process.env.SCRAPER_API_KEY;
   if (!REPO || !TOKEN) throw new Error('no CLAUDINITE_REPO/GITHUB_TOKEN — not in an Actions context');
   if (!scraperKey) throw new Error('SCRAPER_API_KEY is not set');

.claudinite/local/packs/gcec/tasks/create-extractor/task.mjs

@@ -37,12 +37,12 @@ export default {
   agent_preprocessing_timeout: 1800,      // npm ci + the offline suite + a rendered ScraperAPI fetch
 
   // The repo Actions secret this task needs configured (agent-preprocessing
-  // DESIGN §9) — declarative, so adoption and the scheduler can ask the owner for
-  // it rather than letting the task fail mysteriously. Being ABLE to read it here
-  // is what retired `.github/workflows/fetch-page.yml`: that workflow existed only
-  // because the page fetch needed a secret an agent session cannot hold, so the
-  // agent had to dispatch it, poll it, and pull its commit. Preprocessing runs
-  // inside Actions, where the secret already is.
+  // DESIGN §9). The wiring converge stamps it into the scheduler workflow, so the
+  // worker reads it as ordinary env; baselining asks the owner if it isn't set.
+  // Being able to read it at all is what retired `.github/workflows/fetch-page.yml`:
+  // that workflow existed only because the page fetch needed a secret an agent
+  // session cannot hold, so the agent had to dispatch it, poll it, and pull its
+  // commit. Preprocessing runs inside Actions, where the secret already is.
   required_secrets: ['SCRAPER_API_KEY'],
 
   // Eligibility, and nothing more. A request is eligible when it is an open

.claudinite/shared/engine/scheduler/converge-wiring.mjs

@@ -35,13 +35,36 @@ export const CLAUDE_MD = 'CLAUDE.md';
 // The whole line (and its trailing newline) is removed wherever it appears.
 const CORPUS_IMPORT_RE = /^.*@\.claudinite\/shared\/CLAUDE\.md.*\n?/m;
 
+// The repo Actions secrets its scheduled tasks declare via `required_secrets`,
+// deduped and sorted. Async because task discovery is; pure otherwise.
+export async function declaredSecrets(root, config) {
+  const { discoverTasks } = await import('./discover.mjs');
+  const { tasks } = await discoverTasks(root, config);
+  return [...new Set(tasks.flatMap((t) => t.decl?.required_secrets ?? []))].sort();
+}
+
+// Stamp the declared secrets into the scheduler workflow's engine step, beside
+// GITHUB_TOKEN. This is the whole delivery mechanism: GitHub Actions requires each
+// secret to be named statically in the workflow, and a task's `required_secrets` is
+// exactly that list — so the wiring converge writes it, and a worker then reads
+// `process.env.<NAME>` like any other environment variable. No bundle, no parsing,
+// no engine-side selection. Regenerated from the stub each converge, so the list
+// tracks the declarations rather than accumulating.
+export function withDeclaredSecrets(stubText, names = []) {
+  if (!names.length) return stubText;
+  const lines = names.map((n) => `          ${n}: \${{ secrets.${n} }}`).join('\n');
+  return stubText.replace(/^(\s*GITHUB_TOKEN: \$\{\{ github\.token \}\})$/m, `$1\n${lines}`);
+}
+
 // Re-converge the scheduler workflow to the vendored stub, with the cron minute set
 // to this repo's stable hashed value (never guessed — hash-minute.mjs, a pure
-// function of the full name, so re-vendors and this convergence agree). `stubText`
-// is the vendored stub's content (the caller reads it from the mount). Returns true
-// when the file was written (absent, or drifted from the target).
-export function convergeSchedulerWorkflow(root, fullName, stubText) {
-  const target = stubText.replace(/cron:\s*'[^']*'/, `cron: '${hashedCron(fullName)}'`);
+// function of the full name, so re-vendors and this convergence agree) and the
+// declared `required_secrets` stamped into the engine step's env. `stubText` is the
+// vendored stub's content (the caller reads it from the mount). Returns true when
+// the file was written (absent, or drifted from the target).
+export function convergeSchedulerWorkflow(root, fullName, stubText, secretNames = []) {
+  const target = withDeclaredSecrets(stubText, secretNames)
+    .replace(/cron:\s*'[^']*'/, `cron: '${hashedCron(fullName)}'`);
   const path = join(root, SCHEDULER_WORKFLOW);
   const current = existsSync(path) ? readFileSync(path, 'utf8') : null;
   if (current === target) return false;
@@ -92,9 +115,9 @@ export function removeRetiredCorpusImport(root) {
 
 // Converge every wiring surface, returning a flat summary of what changed (empty
 // when the repo was already converged). `stubText` is the vendored scheduler stub.
-export function convergeWiring(root, fullName, stubText) {
+export function convergeWiring(root, fullName, stubText, secretNames = []) {
   const changed = [];
-  if (convergeSchedulerWorkflow(root, fullName, stubText)) changed.push(SCHEDULER_WORKFLOW);
+  if (convergeSchedulerWorkflow(root, fullName, stubText, secretNames)) changed.push(SCHEDULER_WORKFLOW);
   const hooks = ensureHooks(root);
   for (const h of hooks.added) changed.push(`hook:${h}`);
   if (removeRetiredCorpusImport(root)) changed.push(`removed retired ${CLAUDE_MD} corpus import`);
@@ -111,7 +134,9 @@ async function main() {
   const root = process.env.CLAUDINITE_REPO_ROOT || process.cwd();
   const stubPath = join(root, '.claudinite/shared/engine/scheduler/stubs/claudinite-scheduler.yml');
   if (!existsSync(stubPath)) { console.error(`converge-wiring: vendored stub not found at ${stubPath}`); process.exit(1); }
-  const { changed, error } = convergeWiring(root, fullName, readFileSync(stubPath, 'utf8'));
+  const { loadConfig } = await import('../checks/helpers/repo-context.mjs');
+  const secretNames = await declaredSecrets(root, loadConfig(root));
+  const { changed, error } = convergeWiring(root, fullName, readFileSync(stubPath, 'utf8'), secretNames);
   if (error) console.log(`! ${error}`);
   console.log(changed.length ? `converge-wiring: ${changed.join(', ')}` : 'converge-wiring: already converged');
 }

.claudinite/shared/engine/scheduler/preprocess.mjs

@@ -1,8 +1,7 @@
 // The pre-agent preprocessing stage (agent-preprocessing DESIGN §3). The
 // scheduler runs a task's declared `agent_preprocessing` command as a SUBPROCESS
 // before any agent starts — deterministic code work, Action-side, over the one
-// sanctioned non-MCP surface (the Action GITHUB_TOKEN, inherited in `env`) and
-// the repo's Actions secrets, unpacked into its env (§9, `preprocessingEnv` below).
+// sanctioned non-MCP surface (the Action GITHUB_TOKEN, inherited in `env`).
 //
 // The subprocess is the scheduler's child, so its `agent_preprocessing_timeout`
 // is a HARD kill: a manual timer SIGKILLs an overrun and the run is reported
@@ -60,41 +59,6 @@ export function agentRequestPath({ pack, task, slotId }) {
 export function clearAgentRequest(path) { try { rmSync(path, { force: true }); } catch { /* nothing to clear */ } }
 export function agentRequested(path) { return existsSync(path); }
 
-// --- repo secrets for a worker (agent-preprocessing DESIGN §9) ---------------
-// The scheduler workflow hands the engine the repo's secrets as one JSON blob
-// (`CLAUDINITE_SECRETS: ${{ toJSON(secrets) }}` — Actions has no way to name
-// secrets dynamically). Unpacking it into the worker's env is all there is to
-// delivery: a task's `required_secrets` says which ones it NEEDS CONFIGURED (the
-// declaration that drives the adoption/scheduler ask), not which ones it is
-// permitted to read. Workers are tracked, reviewed code holding the Action
-// GITHUB_TOKEN already, so a permission boundary between them would be
-// ceremony — the honest boundary is the repo's own secret list.
-export const SECRETS_BUNDLE_VAR = 'CLAUDINITE_SECRETS';
-
-// Parse the bundle. Missing/blank/malformed reads as empty — a repo with no
-// secrets is the ordinary case, not an error.
-export function parseSecretsBundle(raw) {
-  if (typeof raw !== 'string' || raw.trim() === '') return {};
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-  } catch { return {}; }
-}
-
-// The environment a preprocessing subprocess gets: the scheduler's own env with
-// the raw bundle REPLACED by the secrets it carried, plus the CLAUDINITE_*
-// context. (Replaced, not added alongside — a worker has no use for the blob,
-// and leaving it in invites a worker to parse it instead of reading a name.)
-// An unset secret renders as "" in `toJSON(secrets)`; those are dropped so a
-// worker's `if (!process.env.X)` guard behaves.
-export function preprocessingEnv(parentEnv, context) {
-  const { [SECRETS_BUNDLE_VAR]: bundleRaw, ...rest } = parentEnv;
-  const secrets = Object.fromEntries(
-    Object.entries(parseSecretsBundle(bundleRaw)).filter(([, v]) => typeof v === 'string' && v !== ''),
-  );
-  return { ...rest, ...secrets, ...context };
-}
-
 // A one-line reason for the job summary / an issue comment when preprocessing
 // fails — distinguishing a timeout kill from a non-zero exit.
 export function preprocessingFailure(result) {