feat(iac): engine-side sensitive-output routing through secrets.Provider (v0.27.0) - #588

Merged

intel352 merged 13 commits into

mainfrom

feat/engine-sensitive-output-routing-v2

May 9, 2026

Commits on May 9, 2026

docs(design): engine-side sensitive-output routing through secrets.Provider

intel352
and
claude
committed
f1d33d9
docs(design): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
8a6a736
docs(plan): engine-sensitive-output-routing implementation plan

intel352
and
claude
committed
e2b62d8
docs(plan): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
83b8de7
docs(plan): normalize Task headings to ### per writing-plans spec

intel352
and
claude
committed
b89eef1
chore: lock scope for engine-sensitive-output-routing (alignment passed)

intel352
and
claude
committed
ae29f72
feat(iac/sensitive): Route/Revoke/IsPlaceholder/MaskSensitiveForDiff helpers

intel352
and
claude
committed
22dc809
feat(wfctl): persistResourceWithSecretRouting + Apply call-site routing

intel352
and
claude
committed
6af33ac
feat(wfctl): sanitize-only routing for adoption + refresh paths

intel352
and
claude
committed
351e880
feat(wfctl): infra audit-state-secrets command

intel352
and
claude
committed
3ef449a
feat(wfctl): documented drift-masking no-op for v0.27.0

intel352
and
claude
committed
92782d3
docs: sensitive-output routing + audit-state-secrets command

intel352
and
claude
committed
cf44064
fix(wfctl): address Copilot review + lint G117 on PR #588

intel352
and
claude
committed
79178aa