feat(iac): engine-side sensitive-output routing through secrets.Provider - #587

Closed

intel352 wants to merge 12 commits into

mainfrom

feat/engine-sensitive-output-routing

Commits on May 9, 2026

docs(design): engine-side sensitive-output routing through secrets.Provider

intel352
and
claude
committed
e24cb27
docs(design): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
c020749
docs(plan): engine-sensitive-output-routing implementation plan

intel352
and
claude
committed
22e1d87
docs(plan): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
203c410
docs(plan): normalize Task headings to ### per writing-plans spec

intel352
and
claude
committed
6579281
chore: lock scope for engine-sensitive-output-routing (alignment passed)

intel352
and
claude
committed
925ff11
feat(iac/sensitive): Route/Revoke/IsPlaceholder/MaskSensitiveForDiff helpers

intel352
and
claude
committed
93c5a2b
feat(wfctl): persistResourceWithSecretRouting + Apply call-site routing

intel352
and
claude
committed
2a6ecc4
feat(wfctl): sanitize-only routing for adoption + refresh paths

intel352
and
claude
committed
0bf294d
feat(wfctl): infra audit-state-secrets command

intel352
and
claude
committed
482fdb0
feat(wfctl): documented drift-masking no-op for v0.27.0

intel352
and
claude
committed
930eede
docs: sensitive-output routing + audit-state-secrets command

intel352
and
claude
committed
5df8a99