connectlisted

# connect — connectivity & secrets bootstrap `connect` stands up a project's access to external services (GitHub, Google Cloud, Vultr, Linode, …) with every credential sourced from **1Password** via the `op` CLI. The repo only ever holds references (`op://…`), never values. 1Password holds truth; secrets are injected at runtime and stay revocable. Service-specific connect + smoke-test recipes live in [references/recipes.md](references/recipes.md). ## The secret lifecycle: capture → ingest → shred → inject 1. **Capture.** Make sure `.gitignore` covers `.env`, `.env.local`, and `sa.json` *first*. Then have the developer paste the raw provider keys into a transient `.env`. This file is temporary — it exists only until step 3. 2. **Ingest.** Read `.env` and, for each key, **propose the exact `op item create` command and wait for the developer to confirm** before anything is written to their vault (see Guardrails). Create one item per service. Then write/update a committed **`.env.tmpl`** holding only the `op://<vault>/<item>/<field>` references. 3. **Shred.** Only after each key is confirmed readable from `op` (`op read op://…` succeeds) **and** its smoke-test passes, securely delete the raw file with the plugin's `scripts/shred-env.sh .env`. Verify it's gone. 4. **Inject (steady state).** Run the app with secrets injected from 1Password, never from a plaintext file: ```bash op run --env-file=.env.tmpl -- <command> ``` ## Key policy: one s