infisical: fully bootstrapped — machine identity, env vars, profiles wired

docker-compose.yml

@@ -125,7 +125,7 @@ services:
   # Redis (required by Infisical — Phase 5)
   redis:
     image: redis:7-alpine
-    profiles: ["infisical"]
+    profiles: ["infisical", "full"]
     volumes:
       - redis-data:/data
     healthcheck:
@@ -137,7 +137,7 @@ services:
   # Infisical self-hosted (Phase 5 secrets management)
   infisical:
     image: infisical/infisical:latest
-    profiles: ["infisical"]
+    profiles: ["infisical", "full"]
     depends_on:
       postgres:
         condition: service_healthy

scripts/cutover-checklist.md

@@ -9,7 +9,7 @@ Status: [x] = done, [ ] = pending
 - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
 - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
-- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: infisical). Admin account created (`oikos@hubris.network`). ENCRYPTION_KEY fix: must be 32-char raw string, NOT hex (Infisical docs incorrect). Next: complete org/project/machine-identity setup via browser at http://localhost:8080, then wire `OIKOS_SECRET_BACKEND=infisical` to oikos services.
+- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: full+infisical). Admin: `oikos@hubris.network`. Project: `oikos` (a436936f). Machine identity: `oikos-api` (UA: 82e6e362-bbee-...). ENCRYPTION_KEY must be 32-char raw string (Infisical docs incorrectly say hex). Env vars wired in `.env`: OIKOS_INFISICAL_SITE_URL/CLIENT_ID/CLIENT_SECRET/PROJECT_ID/ENV + OIKOS_SECRET_BACKEND=infisical. SOPS fallback preserved.
 - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path).
 
 ## Cutover