feat(iac): engine-side sensitive-output routing through secrets.Provider#587

Closed

intel352 wants to merge 12 commits into

mainfrom

feat/engine-sensitive-output-routing

Commits on May 9, 2026

docs(design): engine-side sensitive-output routing through secrets.Provider

intel352
and
claude
committed
docs(design): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
docs(plan): engine-sensitive-output-routing implementation plan

intel352
and
claude
committed
docs(plan): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
docs(plan): normalize Task headings to ### per writing-plans spec

intel352
and
claude
committed
chore: lock scope for engine-sensitive-output-routing (alignment passed)

intel352
and
claude
committed
feat(iac/sensitive): Route/Revoke/IsPlaceholder/MaskSensitiveForDiff helpers

intel352
and
claude
committed
feat(wfctl): persistResourceWithSecretRouting + Apply call-site routing

intel352
and
claude
committed
feat(wfctl): sanitize-only routing for adoption + refresh paths

intel352
and
claude
committed
feat(wfctl): infra audit-state-secrets command

intel352
and
claude
committed
feat(wfctl): documented drift-masking no-op for v0.27.0

intel352
and
claude
committed
docs: sensitive-output routing + audit-state-secrets command

intel352
and
claude
committed