eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject validator changes to secret classification

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-06 19:20:04 -05:00
parent fb2e2c5386
commit 9b147bfd96
5 changed files with 90 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/config.md
View File

@@ -243,7 +243,9 @@ public-name representation, JSON marshals only the name, and projection, metadat
histories, diagnostics, effective output,
and resolution snapshots never retain the credential. Validation remains read-only:
in addition to ordinary projected-value comparison, ConfigKit checks the private
resolved state against this load's lookup result. Applications must keep their
resolved state against this load's lookup result. Validator mutation checks also
reject changes to projected field sensitivity, even when a replacement dynamic
concrete type preserves the same textual values. Applications must keep their
validation messages value-free and must not include `Value()` in diagnostics.
For example, a typed pipeline field is declared as: