fix(secretspec): supply a default activation reason so require_reason never blocks shell entry (RIG-2822)

[rigel-mintaka]

secretspec 0.19+ added a require_reason policy defaulting to "agents": when the caller is detected as a coding agent (detect-coding-agent) and no reason is supplied (SECRETSPEC_REASON unset / no with_reason()), every secret-access op fails with SecretSpecError::ReasonRequired, independent of required = false.

devenv's use devenv shell activation resolves secrets in resolve_secretspec_into (devenv/src/devenv/mod.rs) via a bare secrets.validate()?, so any coding agent entering a devenv shell on a cold direnv cache (fresh clone, or an edit to any watched file — devenv.nix/.lock/.yaml/.envrc/toolchain pins) is blocked outright — no toolchain. This hit every repo on the fork (orion, compass, forge, infra).

Fix

Chain with_default_reason("devenv shell activation") before validate() at the single activation resolve site (mod.rs:3703). with_default_reason (secretspec 0.19+, already bundled) fills a reason only when the caller set none, so an explicit SECRETSPEC_REASON / with_reason() still wins and is what gets audited — the reason gate is preserved for genuine interactive secretspec get/export, while automatic shell activation self-describes and no longer blocks.

The other resolve path, resolve_builtin_cachix_auth_token, loads a manifest that hardcodes require_reason = false (mod.rs:313), so it needs no reason and is untouched. Upstream devenv already does the analogous thing there for its own Cachix manifest — this applies the same remedy at the project-activation point.

Verification

• nix build .#devenv — exit 0 (edited crate compiles against secretspec-0.19.1, the pinned rev b90afe38).
• Gate mechanics confirmed against the built secretspec binary on a minimal require_reason-default manifest:
  • as-agent (CLAUDECODE=1) + no reason → ReasonRequired, exit 1 (the bare-validate() pre-fix path)
  • as-agent + --reason → exit 0
  • non-agent + no reason → exit 0 (gate only fires for agents)
• End-to-end acceptance: CLAUDECODE=1 SECRETSPEC_REASON= devenv print-dev-env on that project → exit 0, no ReasonRequired, full dev env emitted. Pre-fix this exits 1.

Follow-through

• Once merged: devenv update devenv bump of orion's devenv.lock, then revert the RIG-2550 stopgap (require_reason = false in orion's secretspec.toml) so the fleet runs the reason gate again with activation self-describing.
• Upstreamable to cachix/devenv — the gate affects any agent using devenv + secretspec 0.19+, not just the fork.

RIG-2822.

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2822