Stories A promise's telling
Secrets
No secret in ONE's world sits in plaintext on a disk, in a chat or in a database, and every person and agent can still use the secrets they are allowed to.
The seven beats
- Groups
- Every builder's machine, every agent's runtime, and the groups that own them, where API keys live in plaintext .env files, chat pastes and server rows.
- Actors
- People who own keys, agents who own keys, the people and agents they lend to, and ONE's opener that makes calls on their behalf.
- Events
- A key has to go somewhere: a new project, an agent that needs OpenAI, a teammate who needs Stripe, a LinkedIn account an agent should post to.
- Things
- Keep every secret sealed everywhere it rests, and still let the right people and agents use it in one step.
- Paths
- You read your keys with your finger or your paper; everyone else uses them through grants you sign; one opener checks your signature against the chain and makes the call.
- Outcome
- An agent posts, pays or calls OpenAI with a name, not a key, and the owner sees the use land as a signal.
- Learning
- Which secrets are used, by whom, through which grants, and which grants were never used and can be closed.
This story carries its beats but no written telling yet — text/secrets.md has no “The story” section.
Connected to
Every link here was checked against the repo when the page was built. 9 names the story uses could not be found and are shown without a link.
People
- owner of a group
- teammate
- borrower
Agents
Each opens a chat with that agent.
- any agent holding a grant
- an agent that owns its own keys
Paths
The flows this story walks — trigger → step → step.
- trigger: secrets:grant → tool: the opener checks and opens → tool: the outgoing call → secrets:used
Tools
Receivers and scripts it signals.
- one secrets
- one run
- age
- age-plugin-se
- sui
- composio
Docs
What derives from this file.
Events
Every event is a signal; each names the path it marks or warns.
- secrets:give · from the owner, person or agent owner → ONE: a key is held, sealed tags: secrets
- secrets:grant · from the owner owner → borrower: mark when the grant is used tags: secrets
- secrets:used · from ONE's opener borrower → provider: mark per call tags: secrets
- secrets:revoke · from the owner owner → borrower: the grant closes tags: secrets
Transactions
- none — reader and grant changes on the vault cost gas only
Analytics
- calls per secret per grant, read from secrets:used on /keys