feat(iac): engine-side sensitive-output routing through secrets.Provider (v0.27.0)#588

Merged

intel352 merged 13 commits into

mainfrom

feat/engine-sensitive-output-routing-v2

May 9, 2026

Commits on May 9, 2026

docs(design): engine-side sensitive-output routing through secrets.Provider

intel352
and
claude
committed
docs(design): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
docs(plan): engine-sensitive-output-routing implementation plan

intel352
and
claude
committed
docs(plan): rev1 of engine-sensitive-output-routing — adversarial findings

intel352
and
claude
committed
docs(plan): normalize Task headings to ### per writing-plans spec

intel352
and
claude
committed
chore: lock scope for engine-sensitive-output-routing (alignment passed)

intel352
and
claude
committed
feat(iac/sensitive): Route/Revoke/IsPlaceholder/MaskSensitiveForDiff helpers

intel352
and
claude
committed
feat(wfctl): persistResourceWithSecretRouting + Apply call-site routing

intel352
and
claude
committed
feat(wfctl): sanitize-only routing for adoption + refresh paths

intel352
and
claude
committed
feat(wfctl): infra audit-state-secrets command

intel352
and
claude
committed
feat(wfctl): documented drift-masking no-op for v0.27.0

intel352
and
claude
committed
docs: sensitive-output routing + audit-state-secrets command

intel352
and
claude
committed
fix(wfctl): address Copilot review + lint G117 on PR #588

intel352
and
claude
committed