vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(secrets-broker): record deferred 'secret put' scripted-namespace edge

Browse Source 
jackdaw-dev observation (2026-08-12): the new-namespace warning is non-blocking +
stderr, so a scripted put suppressing stderr can still mis-namespace silently.
Deliberately not blocking (domain-scoped names would misfire on auto-prefix);
revisit with an opt-in --strict flag only if scripted callers appear.
This commit is contained in:
vh
2026-08-11 23:02:58 -07:00
parent a249073a08
commit a1304b7812
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/secrets-broker/secrets-broker.contract.md
+8
View File
@@ -153,6 +153,14 @@ infra store; the org path remains the escape hatch if per-user ACLs are ever nee
future). future).
- **Bitwarden Secrets Manager** — Vaultwarden does not implement it; not an option. - **Bitwarden Secrets Manager** — Vaultwarden does not implement it; not an option.
## Known limitations (deferred)
- **`secret put` namespace warning is non-blocking + stderr** — an interactive caller
sees the new-top-level-namespace heads-up, but a *scripted* caller that suppresses
stderr can still store an item under a typo'd/missing prefix silently (jackdaw-dev,
2026-08-12). Deliberately not blocking (some names are legitimately domain-scoped,
e.g. `gitea/…`, `certs/…`, so auto-prefixing would misfire). Revisit with an opt-in
`--strict` flag (nonzero exit on a new namespace) only if scripted callers appear.
## Failure modes / rollback ## Failure modes / rollback
- Broker/vault down → lookups fail, but host `.env` are untouched and authoritative - Broker/vault down → lookups fail, but host `.env` are untouched and authoritative