Repository navigation

feat: the credential gate, the credential store, and the commands around them - #2

Merged

vjsrinath merged 44 commits into

mainfrom

feat/gate-core

Sep 6, 2026

Merged

feat: the credential gate, the credential store, and the commands around them#2
vjsrinath merged 44 commits into
mainfrom
feat/gate-core

Commits on Sep 5, 2026
- docs: task breakdown for the gate and the credential store
  
  Srinath Janakiraman
  and
  claude
  committed
  2ca44c1
- feat: canonical config-path grammar (parse/render)
  
  vjsrinath
  and
  claude
  committed
  97823f1
- fix: escape backslash in quoted path keys, not just the quote
  
  vjsrinath
  and
  claude
  committed
  7b09516
- feat: repository policy loader for .stackward.toml
  
  vjsrinath
  and
  claude
  committed
  af6291d
- fix: validate stack_models shape; prove sensitive_parents replace wiring
  
  vjsrinath
  and
  claude
  committed
  686021b
- feat: heuristic credential-detection net and check-config command
  
  vjsrinath
  and
  claude
  committed
  8c2ef8d
- fix: propagate sensitive_keys matches to their subtree
  
  vjsrinath
  and
  claude
  committed
  279e0d1
- fix: stop a YAML parse error leaking the credential, and an uncaught
  
  vjsrinath
  and
  claude
  committed
  e934848
- fix: redact quoted fragments PyYAML's %r interpolates into error messages
  
  vjsrinath
  and
  claude
  committed
  8735725
- fix: redact both repr() delimiter forms, and test the property by shape
  
  vjsrinath
  and
  claude
  committed
  db48ff9
- feat: pre-commit gate over staged content, plus describe_yaml_error rename
  
  vjsrinath
  and
  claude
  committed
  391fd71
- fix: close two fail-open gaps found in review of the pre-commit gate
  
  vjsrinath
  and
  claude
  committed
  95874f0
- feat: hooks install — write the pre-commit gate into a repo's real hooks dir
  
  vjsrinath
  and
  claude
  committed
  8df33b7
- fix: close the fail-open gap in _is_tracked, and stop the e2e tests skipping quietly in CI
  
  vjsrinath
  and
  claude
  committed
  5321d3f
- feat: profile-scoped credential store, encrypted at rest
  
  vjsrinath
  and
  claude
  committed
  ab567ca
- fix: raise the cryptography floor to 44.0, and refuse an empty password
  
  vjsrinath
  and
  claude
  committed
  c1e238e
- feat: login, exec, shell -- run pulumi with a profile's credentials
  
  vjsrinath
  and
  claude
  committed
  de4e841
- fix: scrub the store password from children, and stop leaking a backend URL
  
  vjsrinath
  and
  claude
  committed
  ee36dc8
- fix: close two test-isolation gaps found in re-review
  
  vjsrinath
  and
  claude
  committed
  f929f6a
- feat: set-secrets -- publish declared stack secrets into pulumi config
  
  vjsrinath
  and
  claude
  committed
  d3869c9
- fix: publish plaintext entries, and collapse [required] to one shape
  
  vjsrinath
  and
  claude
  committed
  fcdacd0
- fix: reject secret/plaintext overlap, cover source-file resolution, fix drift edges
  
  vjsrinath
  and
  claude
  committed
  5ba2954
- fix: stop a variable-name collision from crashing the second drift pair
  
  vjsrinath
  and
  claude
  committed
  0ba3353
- feat: add check-passphrase command (Task 9)
  
  vjsrinath
  and
  claude
  committed
  4ba9f6b
- feat: the model net -- declared secrets as a graph, checked against the index
  
  vjsrinath
  and
  claude
  committed
  393c2d7
- fix: self-review -- validate the graph before writing, and guard the gate path
  
  vjsrinath
  and
  claude
  committed
  351fae5
- test: cover the out-of-repo contributor and lockfile pinning path
  
  vjsrinath
  and
  claude
  committed
  06eacb6
- feat: run the model net in the hook, refuse RootModel, verify the bundle
  
  vjsrinath
  and
  claude
  committed
  84bfe83
- fix: close three fail-opens that let check-config exit 0 on a credential
  
  vjsrinath
  and
  claude
  committed
  a3f551f
- feat: provider interface for credentials and secrets (Task 11)
  
  vjsrinath
  and
  claude
  committed
  b2fde4b
- fix: close the gate's fail-opens — index policy, missing policy, isolation
  
  vjsrinath
  and
  claude
  committed
  8b2696f
- docs: scope the LC_ALL assertion to the call site this wave owns
  
  vjsrinath
  and
  claude
  committed
  f249c40
- test: one leak assertion that sees partial and re-encoded disclosure
  
  vjsrinath
  and
  claude
  committed
  2b86044
- test: execute the path grammar's refusals, and fix the model net's locale
  
  vjsrinath
  and
  claude
  committed
  9e9c6cd
- test: prove the stdin-not-argv rule for every shape, and see partial leaks
  
  vjsrinath
  and
  claude
  committed
  429e4c2
- test: the artifact's own bytes are checked by nothing but this parser
  
  vjsrinath
  and
  claude
  committed
  e6e54a5
- docs: two absolute claims in the README were false
  
  vjsrinath
  and
  claude
  committed
  1ff3b50
- test: carry the leak-check respell across to the provider suite
  
  vjsrinath
  and
  claude
  committed
  cc73125
- fix: pin what the credential layer's tests only appeared to check
  
  vjsrinath
  and
  claude
  committed
  cf92973
- test: catch a truncated encoding, not only a complete one
  
  vjsrinath
  and
  claude
  committed
  2faf415
Commits on Sep 6, 2026
- feat: ship `credentials`, and fix the dispatch that hid every lazy command
  
  vjsrinath
  and
  claude
  committed
  a5729f3
- fix: clear eight minor items, two of which were prose authorising a revert
  
  vjsrinath
  and
  claude
  committed
  511ee6b
- test: make the TypedDict fixture portable below 3.12
  
  vjsrinath
  and
  claude
  committed
  e79921e
- chore: never commit agent scratch directories
  
  vjsrinath
  and
  claude
  committed
  63acaaa

Commits

Commits on Sep 5, 2026

Commits on Sep 6, 2026