feat(secrets): add Vault KV v2 backend behind secrets-vault

AGENTS.md

@@ -38,7 +38,7 @@ cargo test -p praxis-policy-core --lib -- test_name
 
 ## Architecture
 
-16-crate workspace implementing a policy engine for
+17-crate workspace implementing a policy engine for
 AI agent traffic. The engine decides who may call
 which tool, what data comes back, and where that
 data goes next.
@@ -62,6 +62,7 @@ builtins/
                 elicitation-ciba
   pdps/         cedar-direct, cel, opa
   session/      valkey
+  secrets/      vault
 
 reference/
   plugins/      pii-scanner, audit-logger (examples)

CHANGELOG.md

@@ -19,6 +19,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ### Added
 
+- **Vault KV v2 secret backend**, behind the `secrets-vault` facade
+  feature. A `kind: vault` provider reads `<mount>/<path>#<field>` through
+  the host `HttpTransport` (no Vault SDK). Auth is Kubernetes or AppRole,
+  with no default. Token renewal is lazy on the next read — nothing
+  spawns a ticker — and a `403` reauthenticates once. Written against
+  the Vault 1.19 KV v2 HTTP API.
+  ([#94](https://github.com/praxis-proxy/policy/issues/94))
+
 - **Safety invariants, written down and tested as a catalog.** The engine's
   fail-closed promise lived in comments and per-seam judgment. `docs/safety-invariants.md`
   lists each claim as something a test can fail, and a fault-injection plugin
@@ -47,6 +55,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 - Added PPE documentation ([#82](https://github.com/praxis-proxy/policy/pull/82))
 
+### Changed
+
+- `execute_with_retry` is public so a `SecretProvider` that holds a host
+  transport can use the same retry policy as plugins.
+
 ### Fixed
 
 - **`ppe-core` self-dev-dependency is path-only.** Same as `ppe-apl-core`: a
@@ -77,6 +90,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - **`make coverage` cleans stale instrumented binaries first.** llvm-cov merges the mappings of every binary it finds, so one left by a run with a different feature set (or a cached `target/` in CI) was counted twice, inflating both the line count and the miss count. ([#86](https://github.com/praxis-proxy/policy/pull/86))
 - **`rustls` bumped to 0.23.45** for [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285): TLS 1.3 handshake messages packed after a key-changing message in the same record were accepted at the wrong encryption level. It reaches the shipped graph through `redis` and `deadpool-redis`, so this is a dependency bump rather than an advisory ignore. Lockfile only, one package, still MSRV 1.96. ([#86](https://github.com/praxis-proxy/policy/pull/86))
 
+
 ## [0.2.0] - 2026-09-03
 
 > **Upgrading from 0.1.0?** Configurations require changes: this release removes ten keys, changes the default dispatch mode, and tightens APL lexical rules. `docs/upgrade-apl.md` lists the required rewrites with before-and-after examples.

Cargo.toml

@@ -25,6 +25,7 @@ members = [
     "builtins/pdps/cel",
     "builtins/pdps/opa",
     "builtins/session/valkey",
+    "builtins/secrets/vault",
     # Reference implementations, not published and not in the `builtins`
     # umbrella. Workspace members so they stay built, linted and tested, and so
     # they keep working as examples of an out-of-tree plugin. Each manifest says
@@ -50,6 +51,7 @@ default-members = [
     "builtins/pdps/cedar-direct",
     "builtins/pdps/cel",
     "builtins/pdps/opa",
+    "builtins/secrets/vault",
     # Reference implementations, not published and not in the `builtins`
     # umbrella. Workspace members so they stay built, linted and tested, and so
     # they keep working as examples of an out-of-tree plugin. Each manifest says
@@ -137,6 +139,7 @@ praxis-policy-pdp-cedar-direct         = { path = "builtins/pdps/cedar-direct",
 praxis-policy-pdp-cel                  = { path = "builtins/pdps/cel",                 version = "0.2.0" }
 praxis-policy-pdp-opa                  = { path = "builtins/pdps/opa",                 version = "0.2.0" }
 praxis-policy-session-valkey           = { path = "builtins/session/valkey",           version = "0.2.0" }
+praxis-policy-secrets-vault            = { path = "builtins/secrets/vault",            version = "0.2.0" }
 
 # Cross-crate inlining and dead-code elimination, one codegen unit for
 # optimization quality.

builtins/secrets/vault/Cargo.toml

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2026 Praxis Contributors
+
+# praxis-policy-secrets-vault — Vault KV v2 `SecretProvider`.
+#
+# Optional and feature-gated (`secrets-vault` on the facade). Absent from
+# the default build: it is a network backend, and a deployment that hands
+# secrets to the process through the platform (files, CSI, a Vault Agent
+# sidecar) needs none of it.
+#
+# No Vault SDK, no generated client, no second HTTP stack. Every call
+# goes through a host-supplied `HttpTransport`, so the process keeps one
+# TLS trust store, one egress policy, and one retry/timeout budget.
+
+[package]
+name = "praxis-policy-secrets-vault"
+description = "PPE secret provider — HashiCorp Vault KV v2."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+keywords.workspace = true
+categories.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+praxis-policy-core = { workspace = true }
+async-trait = { workspace = true }
+serde = { workspace = true }
+serde_yaml = { workspace = true }
+serde_json = { workspace = true }
+bytes = { workspace = true }
+tracing = { workspace = true }
+tokio = { workspace = true }
+zeroize = { version = "1.9.0" }
+
+[dev-dependencies]
+# The `HttpTransport` test double. A dev-dependency so the feature is
+# enabled for test builds only; resolver 3 keeps it out of the normal
+# build of this crate.
+praxis-policy-core = { workspace = true, features = ["test-util"] }
+tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread"] }
+
+[lints]
+workspace = true