From a1304b7812231e93203d162f0779124668e78ad1 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 11 Aug 2026 23:02:58 -0700 Subject: [PATCH] docs(secrets-broker): record deferred 'secret put' scripted-namespace edge jackdaw-dev observation (2026-08-12): the new-namespace warning is non-blocking + stderr, so a scripted put suppressing stderr can still mis-namespace silently. Deliberately not blocking (domain-scoped names would misfire on auto-prefix); revisit with an opt-in --strict flag only if scripted callers appear. --- services/secrets-broker/secrets-broker.contract.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/services/secrets-broker/secrets-broker.contract.md b/services/secrets-broker/secrets-broker.contract.md index 84188de..06235dc 100644 --- a/services/secrets-broker/secrets-broker.contract.md +++ b/services/secrets-broker/secrets-broker.contract.md @@ -153,6 +153,14 @@ infra store; the org path remains the escape hatch if per-user ACLs are ever nee future). - **Bitwarden Secrets Manager** — Vaultwarden does not implement it; not an option. +## Known limitations (deferred) +- **`secret put` namespace warning is non-blocking + stderr** — an interactive caller + sees the new-top-level-namespace heads-up, but a *scripted* caller that suppresses + stderr can still store an item under a typo'd/missing prefix silently (jackdaw-dev, + 2026-08-12). Deliberately not blocking (some names are legitimately domain-scoped, + e.g. `gitea/…`, `certs/…`, so auto-prefixing would misfire). Revisit with an opt-in + `--strict` flag (nonzero exit on a new namespace) only if scripted callers appear. + ## Failure modes / rollback - Broker/vault down → lookups fail, but host `.env` are untouched and authoritative