# TB-015 — Use Vault for real

**Status:** not started  
**Your call:** _(unset — talk first)_

---

## Talk first

> **Stop.** Don't read Reference until we've talked.
> In chat, say **"let's do TB-015"** or **"use vault for real"**.

**In one sentence:** Vault runs but secrets live in stack.env — integrate Vault for CI/rotation without changing git-canonical deploy.

**Why it came up:** Optional complexity; only worth it if you want rotation or CI secret centralization.

### Questions

1. What problem would Vault solve that stack.env doesn't?
2. If 'nothing really' — drop this.

### Your options

| Option | Meaning |
|--------|---------|
| **Do it** | We're doing this — I'll implement or walk you through it |
| **Later** | Keep on the list, not now |
| **Drop** | Remove from plan — totally fine |
| **Tweak** | Change scope; tell me how |

### What we decided

| | |
|---|---|
| **Decision** | |
| **Notes** | |
| **Date** | |

---

<details>
<summary>Reference (only open if we're doing it)</summary>

### Stack / files

portainer-compose.yml, scripts

### If we do it — rough steps

1. Define Vault vs stack.env boundary
2. Migrate one token (e.g. github-runner)

### Done when

- [ ] Clear use case — or dropped

</details>