Migrate all plaintext secrets to OpenClaw SecretRef objects backed by 1Password

[NOVA-Openclaw]

Problem

We currently store API keys and credentials as plaintext strings across multiple config files and potentially source code. OpenClaw now has a built-in external secrets manager (openclaw secrets) that supports SecretRef objects with exec-based providers, including native 1Password CLI (op) integration.

Current State

• ~/.openclaw/openclaw.json — at least 4 plaintext apiKey values (model providers, skills)
• ~/.openclaw/.env — environment variables with secret values
• ~/.openclaw/agents/*/agent/auth-profiles.json — potential plaintext credentials
• Source code — any hardcoded secrets, tokens, or credentials in NOVA repos (nova-memory, nova-cognition, nova-relationships, nova-openclaw fork)
• 1Password CLI — already installed (op v2.32.0) but not integrated

Desired State

All secrets replaced with SecretRef objects pointing to 1Password:

{
  "source": "exec",
  "provider": "onepassword",
  "id": "value"
}

With a provider config like:

{
  "secrets": {
    "providers": {
      "onepassword": {
        "source": "exec",
        "command": "/home/linuxbrew/.linuxbrew/bin/op",
        "args": ["read", "op://VAULT/ITEM/FIELD"],
        "passEnv": ["HOME"],
        "jsonOnly": false
      }
    }
  }
}

Scope

Phase 1: Audit

1. Run openclaw secrets audit --check to identify all plaintext secrets in OpenClaw config
2. Grep all NOVA repos for hardcoded secrets, tokens, API keys, passwords
3. Check .env files, auth-profiles.json, any legacy auth.json
4. Document every secret location and what it's used for

Phase 2: 1Password Setup

1. Ensure all secrets exist in 1Password vault(s) with consistent naming
2. Verify op CLI can read each secret non-interactively (service account or biometric)
3. Test exec provider connectivity from the OpenClaw gateway process

Phase 3: Migration

1. Run openclaw secrets configure to set up the exec provider
2. Map each plaintext field to its 1Password SecretRef
3. Run preflight validation
4. Apply migration (one-way scrub of plaintext)
5. Run openclaw secrets audit --check to confirm clean state

Phase 4: Source Code Scan

1. Scan all NOVA repos for any remaining hardcoded secrets
2. Replace with env var references or SecretRef patterns as appropriate
3. Add .gitignore / pre-commit hooks to prevent future secret commits

Acceptance Criteria

• openclaw secrets audit --check returns clean (exit 0)
• Zero plaintext API keys in openclaw.json
• Zero plaintext secrets in .env (migrated to SecretRef)
• All auth-profiles use keyRef/tokenRef instead of plaintext
• Source code scan across all NOVA repos finds no hardcoded secrets
• Gateway starts successfully with all secrets resolved from 1Password
• openclaw secrets reload works without restart
• Documentation updated with our 1Password provider config pattern

Technical Notes

• OpenClaw docs: docs/gateway/secrets.md, docs/cli/secrets.md
• 1Password exec example in upstream docs
• op binary path: /home/linuxbrew/.linuxbrew/bin/op
• May need allowSymlinkCommand: true + trustedDirs if op is symlinked
• SecretRef in-scope fields (v1): models.providers.*.apiKey, skills.entries.*.apiKey, channels.googlechat.serviceAccount, auth-profiles keyRef/tokenRef

Priority

High — plaintext secrets on disk is a security exposure.