eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Document Notarius credential forwarding

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 14:36:44 +00:00
parent cc43906ae9
commit 5b92b3e790
12 changed files with 157 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/internal/configuration.md
View File

@@ -168,6 +168,10 @@ Configuration stores credentials as ConfigKit typed references. A successful
load resolves their values inside the opaque typed boundary, while this safe
projection serializes only `EnvName()` identities. Credential-value changes are
therefore never hashed; reference-name changes remain ordinary provenance.
The optional Notarius credential follows the same path even for disabled or
resumable extraction; normalization copies the opaque reference without reading
or resolving it again. Direct YAML serialization has a configuration-owned safe
projection so only the reference name can leave this boundary.
`recomputePipelineEffectiveDigest` is the single package-owned refresh point
for later runtime expansion.