Module manifest 

Per-project secret manifest per ADR-020 §4.

A project that uses devboy-tools declares its dependency on secrets in .devboy/secrets.toml checked into the repository. Three categories of declarations are recognised:

1. required and optional — references into the secret namespace. doctor fails the exit code on a missing required path; missing optional paths surface as informational.
2. [overrides."<path>"] — behavioural overrides applied on top of the global-index entry for that path. Only three fields may be overridden (gate, rotate_every_days, description); attempts to override anything else are rejected at parse time with deny_unknown_fields so drift between project and global cannot grow silently.
3. [secret."<path>"] — project-local metadata for a path that does not exist in the global index. The loader treats such a path as if its global entry were absent (the merge logic in P1.4 reads from the manifest exclusively for these paths).

File layout

# .devboy/secrets.toml

required = [
    "team/gitlab/token-deploy",
    "personal/github/pat",
]

optional = ["personal/slack/notify-token"]

[overrides."team/gitlab/token-deploy"]
gate              = "touchid"
rotate_every_days = 30
description       = "Used by the staging deploy pipeline"

[secret."sandbox/example-provider/token"]
description   = "Sandbox-only; recreated per-developer"
retrieval_url = "https://example-provider.dev/account/api-tokens"
pattern_id    = "generic-bearer"

Path validation

Every path that appears in any of the four positions is parsed through SecretPath::parse at load time. Invalid paths produce ManifestError::Path with a PathRole tag identifying which position the bad path appeared in, so error messages can point at the right TOML location.

Structs

OverrideEntry

Behavioural override applied to a path whose canonical metadata lives in the global index.

ProjectManifest

In-memory representation of .devboy/secrets.toml.

Enums

ManifestError

Failure modes when loading or parsing a ProjectManifest.

PathRole

Position in the manifest where a bad path was encountered.

Constants

MANIFEST_RELATIVE_PATH

Conventional path of the per-project manifest, relative to the project root.