Atlas: the entrypoint reads its own secrets at cold start

Branch issue-1317-secret-bootstrap-module · Story: pramaan-io/pramaan-spec#1317 · Provenance: pramaan-docs ADR-121 (env delivery, D3 boot read + D5 §6 carve-out), amends ADR-110 §6 (thin brain), refines ADR-116 (OpenRouter key) & ADR-118 (Logfire token). Gates Story-1214 Phase-2 cutover.

🛰️ 1 · Satellite — why this exists

Atlas's brain reads two secrets with plain os.getenv: OPENROUTER_API_KEY (inference, ADR-116) and LOGFIRE_TOKEN (observability, ADR-118). Today those values arrive because scripts/deploy-atlas-staging.sh resolves them with deployer creds and injects them as plaintext runtime env vars. ADR-109 makes Terraform the sole IaC and retires that imperative deploy script — and the Terraform runtime resource deliberately leaves the two secret values empty so they never land in tfstate.

The naïve fix — keep an out-of-band injector that POSTs the secrets onto the runtime after terraform apply (ADR-121 Option A) — detonates on three doctrines: it needs lifecycle { ignore_changes = [environment_variables] }, which blinds terraform plan (ADR-109's single drift detector) on exactly the surface most likely to drift; it resurrects the bespoke deploy script ADR-109 deletes; and it leaves secrets retrievable by anyone with DescribeAgentRuntime.

The decision (ADR-121 D3, Option B): the agent's entrypoint reads its own secrets from Secrets Manager at cold start and sets os.environ before the brain reads it. The brain is unchanged — still os.getenv-only. Plaintext then exists in exactly one place: this process's memory. This Story is the pramaan-agents half; it must exist before the Phase-2 cutover (enable_atlas_runtime=true).

✈️ 2 · Airplane — the shape of the change

cold start (main.py)
      │  bootstrap_secrets()                ← NEW, runs FIRST (before any os.getenv)
      ▼
for (ARN_env → target_env) in:
   OPENROUTER_SECRET_ARN → OPENROUTER_API_KEY
   LOGFIRE_SECRET_ARN    → LOGFIRE_TOKEN
      │
      ├─ ARN unset?            → skip            (local dev / not wired)
      ├─ target already set?   → skip            (local .env / preset env WINS)
      └─ else GetSecretValue(ARN) → os.environ[target] = SecretString
                 │ any error (AccessDenied, SM down, empty) → leave UNSET, never raise
      ▼
configure_observability()   ← now sees LOGFIRE_TOKEN if it was loaded
brain run (provider.py)     ← now sees OPENROUTER_API_KEY if it was loaded
                              no key → existing fail-closed (provider raises / Logfire no-op)

One new module (secrets_bootstrap.py — the only boto3/Secrets Manager surface in Atlas), one call site (main.py cold start), one dep (boto3), plus the ADR-110 §6 CI grep — added here for the first time, together with the secretsmanager allowance it fences.

🔬 3 · Microscope — what was added, and WHY each piece

✅ 4 · Verification