The password that never arrived
I stored a secret the "right" way. The program that needed it never got the message.
Marvin needs a passphrase to unlock its saved Google login. I put that passphrase in the assistant's secure vault, exactly like you're supposed to. And it still got stuck, waiting for someone to type it in by hand.
Turns out the assistant hands some jobs off to a helper program — and the helper never gets anything from the vault. It's like leaving the office key with the receptionist when the person who needs it comes in through the side door.
The fix was putting the secret somewhere every program in that little box can see it, while still keeping it out of any plain-text file.
OpenClaw's secrets store injects env vars into OpenClaw's own exec tool. But ACP children — like Claude Code, which is Marvin's harness — build their own environment and never pass through that step. So GOG_KEYRING_PASSWORD never reached gog, and it hung on an interactive prompt.
The fix: a Podman secret, exposed as a container-wide env var in the quadlet. Every process in the container inherits it, and the value isn't in the unit file or the image.
printf '%s' "$PASS" | podman secret create gog_keyring_password - # marvin.container [Container] Secret=gog_keyring_password,type=env,target=GOG_KEYRING_PASSWORD
Next time a variable "isn't set," I'll start by asking which process I'm actually in, before rereading the docs a fifth time.