Centralize deployment.secrets through DeploymentState

[jonathonbyrdziak]

Summary

• Adds secretsMode() and setSecretsMode() to DeploymentState, making it the single source of truth for reading/writing deployment.secrets
• Production nodes (those with a NodeConfig entry) read exclusively from ~/.protocol/.node/nodes/<project>.json — never falling back to the repo-level protocol.json
• Dev/staging (no NodeConfig) reads from the repo-level protocol.json as before
• Replaces all 5 direct Json::read('deployment.secrets') calls and all 9 Json::write('deployment.secrets') calls across the codebase
• Moves aws-secrets.log to /var/log/protocol/

Root cause: On production, SecretsProvider was reading deployment.secrets from protocol.json inside the release directory (e.g. /home/ec2-user/enterprise-gateway-releases/v1.0.9/protocol.json), which had "encrypted" baked into the release tag. The node-level config at ~/.protocol/.node/nodes/enterprise-gateway.json had the correct "aws" value but was never consulted.

Files changed

• DeploymentState.php — new secretsMode() / setSecretsMode() methods
• SecretsProvider.php, Soc2Check.php, ProtocolStatus.php, ConfigSave.php, Migrate.php — replaced direct reads
• AwsSecretsInit.php, ConfigInit.php, Migrate.php, ProtocolInit.php — replaced direct writes
• AwsSecretsHelper.php — log path moved to /var/log/protocol/

Test plan

• Run protocol restart on gateway production — verify protocol exec env shows AWS secrets
• Verify /var/log/protocol/secrets-provider.log shows mode=aws (not encrypted)
• Run protocol config:init on a dev machine — verify protocol.json still gets deployment.secrets written
• Run protocol aws:init on a dev machine — verify both protocol.json and NodeConfig are updated

🤖 Generated with Claude Code