Vault specialist: swap secrets-manager to vault.specialist topology

Update secrets-manager rig to use canonical managed app convention:
pod id vault, member id specialist, agent_ref pointing to the new
vault-specialist AgentSpec. Summary explicitly mentions the Vault
specialist agent.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

packages/daemon/specs/rigs/launch/secrets-manager/rig.yaml

@@ -1,9 +1,10 @@
 version: "0.2"
 name: secrets-manager
 summary: >
-  A rig backed by HashiCorp Vault in dev mode. Proves the services
-  substrate: Vault boots before agents, health is gated, and the env
-  receipt is captured. Agents can read secrets via the Vault HTTP API.
+  HashiCorp Vault in dev mode with a dedicated Vault specialist agent.
+  Vault boots before the specialist launches, health is gated, and the
+  env receipt is captured. The specialist can read, write, list, and
+  delete secrets via the Vault HTTP API.
 
 services:
   kind: compose
@@ -23,11 +24,11 @@ services:
         command: "vault status -address=http://127.0.0.1:8200"
 
 pods:
-  - id: dev
-    label: Development
+  - id: vault
+    label: Vault
     members:
-      - id: impl
-        agent_ref: "local:../../../agents/development/implementer"
+      - id: specialist
+        agent_ref: "local:../../../agents/apps/vault-specialist"
         runtime: claude-code
         profile: default
         cwd: "."

packages/daemon/test/spec-library-starters.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { readFileSync, existsSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
 import { SpecReviewService } from "../src/domain/spec-review-service.js";
 import { SpecLibraryService } from "../src/domain/spec-library-service.js";
 import { rigPreflight, type RigPreflightInput } from "../src/domain/rigspec-preflight.js";
@@ -95,6 +96,26 @@ describe("Starter specs", () => {
     expect(demo!.hasServices).toBeFalsy();
   });
 
+  it("secrets-manager rig uses canonical vault.specialist topology", () => {
+    const yaml = readFileSync(join(SPECS_ROOT, "rigs/launch/secrets-manager/rig.yaml"), "utf-8");
+    const parsed = parseYaml(yaml) as Record<string, unknown>;
+    const pods = parsed["pods"] as Array<Record<string, unknown>>;
+    expect(pods).toHaveLength(1);
+
+    const pod = pods[0]!;
+    expect(pod["id"]).toBe("vault");
+    expect(pod["label"]).toBeDefined();
+
+    const members = pod["members"] as Array<Record<string, unknown>>;
+    expect(members).toHaveLength(1);
+    expect(members[0]!["id"]).toBe("specialist");
+    expect(members[0]!["agent_ref"]).toContain("vault-specialist");
+
+    // Summary must explicitly mention the specialist
+    const summary = (parsed["summary"] as string).toLowerCase();
+    expect(summary).toContain("specialist");
+  });
+
   it("starter summaries position implementation-pair as the first success, demo as the launch-grade starter, and product-team as the advanced preview", () => {
     const lib = new SpecLibraryService({
       roots: [{ path: SPECS_ROOT, sourceType: "builtin" }],