chore(devbox): clean infisical contract drift

Author: altaywtf

AGENTS.md

@@ -128,7 +128,7 @@ For personal security drift:
 - Use Conventional Commits.
 - Keep `Brewfile` shared and profile-neutral.
 - Put laptop-only apps in `Brewfile.personal`.
-- Put shared Mac mini and devbox tools in `Brewfile.devbox`.
+- Put shared agent-host and devbox tools in `Brewfile.devbox`.
 - Keep Codex setup install-only here; agent rule links belong to
   [uinaf/agents](https://github.com/uinaf/agents).
 - Edit dotfiles in `chezmoi/`, not generated files in `$HOME`. Follow

README.md

@@ -16,7 +16,7 @@ machine-local.
 | --- | --- | --- |
 | Shared | Base tools every uinaf Mac should have. | `Brewfile` |
 | Personal | A human-operated laptop or desktop. | `Brewfile` + `Brewfile.personal` |
-| Devbox | A shared Mac mini or SSH-first agent host. | `Brewfile` + `Brewfile.devbox` |
+| Devbox | A shared SSH-first agent host. | `Brewfile` + `Brewfile.devbox` |
 
 Most users want `personal`. Always-on agent hosts use `devbox`.
 
@@ -139,7 +139,7 @@ audit, and macOS Security Compliance Project flow.
 | Need | Read |
 | --- | --- |
 | Install or update a Mac | [Bootstrap guide](docs/bootstrap.md) |
-| Operate a shared agent Mac mini | [Devbox setup](docs/devbox.md) |
+| Operate a shared agent host | [Devbox setup](docs/devbox.md) |
 | Understand dotfile source state | [Chezmoi source state](docs/chezmoi.md) |
 | Understand mise tasks and runtime pins | [Mise tasks](docs/mise.md) |
 | Help as an AI agent | [Agent guide](AGENTS.md) |

SECURITY.md

@@ -12,12 +12,15 @@ problems, or anything that could help compromise a machine.
 Environment variables are process state, not secure storage. Any program run in
 that environment can read them and pass them to child processes.
 
-Do not place long-lived service tokens in shell startup files, launchd plists,
-process-compose YAML, or tracked dotenv files. Store them in machine-local
-secret storage, such as a root-owned token file on a headless devbox, and fetch
-them inside the smallest wrapper that needs them. Generated secret files must be
-owner-only, usually a `0711` root-owned directory and `0400` service-user-owned
-file when another Unix user has to read them.
+Do not place long-lived service tokens, Infisical access tokens, or machine
+identity credentials in shell startup files, launchd plists, process-compose
+YAML, tracked dotenv files, or generated runtime env files.
+
+Human-operated machines may use human secret-manager sessions. Agent devboxes
+use Infisical machine identity auth through the devbox contract in
+[Devbox setup](docs/devbox.md): persistent Universal Auth client credentials
+live only in owner-only local config, and short-lived access tokens are minted
+for the smallest command boundary that needs them.
 
 ## Local Audits
 

docs/devbox.md

@@ -288,7 +288,7 @@ Run the normal bootstrap check for each user:
 ./scripts/verify/bootstrap.sh --profile devbox
 ```
 
-Devbox Git config includes `/opt/homebrew` as a safe directory so both admin
+Devbox Git config includes `/opt/homebrew` as a safe directory so local admin
 users can operate on the shared Homebrew prefix without Git dubious-ownership
 failures.
 

scripts/secrets/configure-infisical-devbox.sh

@@ -167,7 +167,7 @@ chmod 700 "$config_dir"
 mkdir -p "$machine_config_dir"
 chmod 700 "$machine_config_dir"
 
-tmp_config="$(mktemp "${TMPDIR:-/tmp}/uinaf-devbox-env.XXXXXX")"
+tmp_config="$(mktemp "${TMPDIR:-/tmp}/uinaf-devbox-config.XXXXXX")"
 tmp_machine="$(mktemp "${TMPDIR:-/tmp}/uinaf-infisical-machine.XXXXXX")"
 trap 'rm -f "$tmp_config" "$tmp_machine"; unset infisical_client_secret' EXIT
 

scripts/verify/devbox-services.sh

@@ -98,7 +98,6 @@ check_config() {
     infisical_domain="${INFISICAL_DOMAIN:-$infisical_domain}"
     infisical_project_id="${INFISICAL_PROJECT_ID:-$infisical_project_id}"
     infisical_env="${INFISICAL_ENV:-$infisical_env}"
-    infisical_secret_path="${INFISICAL_SECRET_PATH:-$infisical_secret_path}"
   else
     if [ "$machine_auth_required" = "1" ]; then
       fail "missing $config_path"