No way to give a Task a secret: EnvVar has no valueFrom and TaskSpec has no modelRef #348

Summary

There is no way to give a Task a credential except as a literal string in its spec, and that literal is readable back through the API.

Model exists and holds a secret reference, but nothing connects it to a Task.

AX v0.3.0 (d8ed0fe).

The gap

EnvVar has two fields:

// pkg/apis/v1alpha1/ax.pb.go
Name  string `protobuf:"bytes,1,opt,name=name,proto3"  json:"name,omitempty"`
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`

No valueFrom, no secret reference. And TaskSpec has no model reference:

Suspend, Image, Command, Env, Resources, Workspaces, Gateway, Debug

Model does take one — spec.secretKey.{name,key} — but it is consumed by AX's own components (internal/model/client.go, e.g. planning a Workspace from its goal). A Task cannot reference a Model, so an agent that calls a model itself has nowhere to get the key from.

What that means in practice

Our task talks to an LLM gateway, so its spec carries the key:

env:
  - name: LITELLM_KEY
    value: "sk-lab-..."

and it comes straight back out:

$ ax get task susp2
        - name: LITELLM_KEY
          value: sk-lab-b6a69e5a84d6add8bbb8ae7d83e8991b03a69d0b72be42b2

Anyone who can reach the AX API can read every task's credentials. It also means the rendered manifest is a secret-bearing file that has to be created, chmod'd, applied and deleted for every run, rather than a checked-in declaration.

docs/manifests.md shows kubectl create secret for the Model flow, which reads as though secret handling is covered — it is, but only for AX's own model calls, not for anything the task does.

Suggestions, roughly in order of cost

• valueFrom.secretKeyRef on EnvVar, mirroring Kubernetes — the least surprising option
• spec.modelRef on TaskSpec, injecting the referenced Model's key into the sandbox
• failing both, a note in docs/manifests.md that task credentials are plaintext and API-readable, so people do not assume the Model secret flow covers them

Happy to test a patch on this cluster.