feat(secrets): record which secrets each run resolves, and surface it per secret - #6823

Merged

icecrasher321 merged 20 commits into

feat/secret-usage-audit-trail

Aug 19, 2026

Commits on Aug 18, 2026

feat(secrets): record which secrets each run resolves and surface it per secret

icecrasher321
and
claude
committed
85930d7
Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail
icecrasher321
committed
aadee19
chore(audit): register the secret-usage route in the validation baseline

icecrasher321
and
claude
committed
a7539cf
fix(secrets): keep rollup metadata with its run, and stop shadowed bindings faking usage

icecrasher321
and
claude
committed
cfc14e4
chore(db): format the generated migration snapshot

icecrasher321
and
claude
committed
a20c61d
fix(secrets): detect every rebinding of the environment identifier, not just declarations

icecrasher321
and
claude
committed
a7a5fff
fix(secrets): apply the rebinding rule to shell, and say when a run's log is gone

icecrasher321
and
claude
committed
d293432
Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail

icecrasher321
and
claude
committed
7f0c29d
fix(secrets): writing a name is not reading it, and a bare mention is not a rebinding

icecrasher321
and
claude
committed
3998ac6
fix(secrets): an update reads before it stores, and a del target may be parenthesized

icecrasher321
and
claude
committed
0e71127
fix(secrets): stop excluding Python writes, which kept leaking in the unsafe direction

icecrasher321
and
claude
committed
f6c137c
fix(secrets): report recognized reads instead of proving they are not reads

icecrasher321
and
claude
committed
edad2e8

Commits on Aug 19, 2026

refactor(secrets): drop the last write-vs-read special case

icecrasher321
and
claude
committed
57d1217
refactor(secrets): ship only the fields the trail actually shows

icecrasher321
and
claude
committed
1e93f40
fix(secrets): report referenced code secrets, not only ones that surface in output

icecrasher321
and
claude
committed
ba4e194
fix(secrets): shell escaping is backslash parity, not adjacency

icecrasher321
and
claude
committed
4e66984
Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail

icecrasher321
and
claude
committed
c00bf47
fix(secrets): recognize destructured environment reads

icecrasher321
and
claude
committed
2ad0882
fix(secrets): one receiver rule for destructured reads, parentheses included

icecrasher321
and
claude
committed
a040b2d
fix(secrets): a dot in prose is not a qualifier, and a literal computed key is a subscript

icecrasher321
and
claude
committed
01fa6ca