BUG-080: dotf secrets run without --only is dead for every consumer — DOCKERHUB_TOKEN maps to an item that does not exist

[mlorentedev]

Symptom

Any dotf secrets run -- <cmd> without --only fails outright:

$ dotf secrets run -- true
Error: bw resolve dockerhub/password: bw item not found: bw serve item "dockerhub": not found

Deterministic — 3/3 attempts, not the intermittent bw serve flakiness tracked separately.

Blast radius

This is not cosmetic. dotf secrets run -- with no scope is the injection path used by:

• the pi shell function (pi () { dotf secrets run -- pi "$@" }) — so pi does not start at all
• dotf spec review (cli/internal/cmd/review.go builds 'dotf' 'secrets' 'run' '--' 'pi' ...), so the adversarial review gate is unrunnable for every spec in every repo

The second one is how this was found: a kubelab spec could not be archived because its mandatory review could not launch.

Cause

secrets/registry.yaml maps both DockerHub entries to a vault item named dockerhub:

  - id: DOCKERHUB_TOKEN
    bw: { item: dockerhub, field: password, folder: apps }
  - id: DOCKERHUB_USERNAME
    bw: { item: dockerhub, field: username, folder: apps }

The vault has no dockerhub. It has DockerHub — unfoldered, carrying username, password and a separate PAT field. Lookup is by exact name, so the registry misses it.

Second defect, worth fixing in the same pass

Even once the name resolves, DOCKERHUB_TOKEN is mapped to field: password — the account password, not the PAT sitting beside it. A CI image-push consumer (consumers: ["ci:image-push"]) would receive the account credential instead of a revocable scoped token.

Suggested fix

1. Rename the vault item DockerHub → dockerhub, move it to apps.
2. Repoint DOCKERHUB_TOKEN at field: PAT.
3. Consider whether dotf secrets run should degrade for an unresolvable secret the caller did not ask for — today one broken registry row disables the whole unscoped injection path for every consumer. secrets render already tolerates absent secrets; run does not.

Point 3 is the actual robustness bug: without it, the next registry/vault drift silently takes pi and the review gate down again.

Evidence

• dotf secrets verify — DOCKERHUB_TOKEN/DOCKERHUB_USERNAME both FAILED ... not found, every other bw entry resolves
• vault inventory (metadata only, no values): item DockerHub, unfoldered, fields username, password, PAT
• dotf secrets run --only NAN_API_KEY -- ... succeeds, proving the failure is the unscoped resolution and not the backend