dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(secrets): G-2..G-6 adoption design + 3 per-repo plans

Browse Source 
Shared design (two resolution layers, wiring template, master-key/clustering
fork) + per-repo executable plans with code-verified anchors and co-located
.tasks.json:
  - mxaccessgw (G-4/G-5/G-6, 8 tasks)
  - otopcua    (G-2/G-4/G-5/G-6, 10 tasks, 2 slices)
  - scadabridge (G-3/G-4/G-5/G-6, 10 tasks, 2 slices)
Linked from components/secrets/GAPS.md.
This commit is contained in:
Joseph Doherty
2026-07-16 09:19:33 -04:00
parent e347286f28
commit 6be5f746d5
8 changed files with 1392 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/secrets/GAPS.md
+17
View File
@@ -5,6 +5,23 @@ The delta between each project's [`current-state`](current-state/) and the
reference-consumer-proven**; everything here is per-app adoption of an existing lib (not lib
construction).
## Design + implementation plans (2026-07-16)
G-2 … G-6 are now planned. Shared design + three per-repo executable plans (task-metadata'd,
code-verified anchors, co-located `.tasks.json`):
- [`docs/plans/2026-07-16-secrets-adoption-design.md`](../../docs/plans/2026-07-16-secrets-adoption-design.md)
— shared design: library API, the two resolution layers (pre-host `${secret:}` config
expander vs runtime `ISecretResolver`), wiring template, master-key/clustering fork.
- [`docs/plans/2026-07-16-secrets-adoption-otopcua.md`](../../docs/plans/2026-07-16-secrets-adoption-otopcua.md)
— **G-2 + G-4 + G-5 + G-6** (10 tasks, 2 slices; Layer-A config + Layer-B driver secrets).
- [`docs/plans/2026-07-16-secrets-adoption-scadabridge.md`](../../docs/plans/2026-07-16-secrets-adoption-scadabridge.md)
— **G-3 + G-4 + G-5 + G-6** (10 tasks; incl. claim-type verification + committed-plaintext cleanup).
- [`docs/plans/2026-07-16-secrets-adoption-mxaccessgw.md`](../../docs/plans/2026-07-16-secrets-adoption-mxaccessgw.md)
— **G-4 + G-5 + G-6** (8 tasks; single-box, no Layer B).
G-7/G-8 remain design-only/deferred (below).
## Cross-cutting observations
- **No app has `${secret:}` resolution today.** All three assemble config with the stock