eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preserve secret sensitivity across sibling inheritance

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-29 22:56:10 +00:00
parent f916e7d1f9
commit 501d59f21b
3 changed files with 182 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/roadmap/implementation.md
View File

@@ -244,6 +244,13 @@ history budgets. Run the everyday checker.
## Stage 6 — Preserve sensitivity through inheritance
**Completed 2026-09-29.** Sensitivity classification now follows corresponding
source/destination paths through structural transfers and controls to a fixed
point, while leaving neighboring fields unclassified. Historical replacement
evidence remains redacted, and inherited secret references remain unresolved
until the existing typed lookup point. Focused secret/history tests and
`./scripts/check.sh` passed. Public loading remains unchanged.
Connect transfer dependencies to existing secret classification and historical
redaction. Classify both source and destination paths under schema and
`Definition.Secret` rules; propagate sensitivity through chains/nested copies.