Reject validator changes to secret classification

secret.go

@@ -139,3 +139,26 @@ func schemaSecretRoot(schema *schemaDescriptor, path Path) (Path, bool) {
 	}
 	return Path{}, false
 }
+
+// Dynamic type replacement can change classification even when projected text
+// is equal. Validators must preserve this inspection metadata as well as values.
+func projectedSensitivity(root *document.Node) map[string]Path {
+	result := make(map[string]Path)
+	var visit func(*document.Node, Path)
+	visit = func(node *document.Node, path Path) {
+		if node == nil {
+			return
+		}
+		if node.Sensitive {
+			result[path.String()] = path.clone()
+		}
+		for _, entry := range node.Mapping {
+			visit(entry.Value, path.Key(entry.Key))
+		}
+		for i, child := range node.Sequence {
+			visit(child, path.Index(i))
+		}
+	}
+	visit(root, Path{})
+	return result
+}