feat(secrets): scoped-store v1 + KMS/OIDC KeyProvider (v2)#358

Draft

Cre-eD wants to merge 13 commits into

mainfrom

design/scoped-store-v1

Commits on Jul 3, 2026

docs(secrets): scoped-store v1 implementation spec (secrets.<scope>.yaml)
Cre-eD
committed
docs(secrets): settle scoped-store v1 scope + bake in 7 P0 fixes
Cre-eD
committed

Commits on Jul 4, 2026

feat(secrets): scoped-store crypto core (secrets.<scope>.yaml)
Cre-eD
committed
docs(secrets): align scoped-store spec with sc-cipher implementation
Cre-eD
committed
feat(secrets): sc secrets scope CLI (set/get/list/delete/allow/disallow/lint/doctor)
Cre-eD
committed
fix(secrets): address multi-model review of scoped store (Codex + Gemini)
Cre-eD
committed
feat(secrets): key-driven deploy-time scoped resolution
Cre-eD
committed
fix(secrets): close deploy-resolution gaps from Codex review
Cre-eD
committed
test(secrets): provisioner-level scoped deploy-path coverage
Cre-eD
committed
fix(secrets): close review-panel P0s (ed25519 downgrade, RSA chunk malleability) + P1s
Cre-eD
committed
feat(secrets): address remaining review findings (stack binding, lint dup, gate, docs, tests)
Cre-eD
committed
refactor(secrets): envelope-encrypt scoped values (round-2 review)
Cre-eD
committed

Commits on Jul 5, 2026

feat(secrets): KMS-recipient KeyProvider for scoped secrets (RFC phase 2, keyless via OIDC)
Cre-eD
committed