Repository navigation

feat(secrets): record which secrets each run resolves, and surface it per secret - #6823

Merged

icecrasher321 merged 20 commits into

stagingfrom

feat/secret-usage-audit-trail

Aug 19, 2026

Merged

feat(secrets): record which secrets each run resolves, and surface it per secret#6823
icecrasher321 merged 20 commits into
stagingfrom
feat/secret-usage-audit-trail

Commits on Aug 18, 2026
- feat(secrets): record which secrets each run resolves and surface it per secret
  
  Vikhyath Mondreti
  and
  claude
  committed
  85930d7
- Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail
  Vikhyath Mondreti
  committed
  aadee19
- chore(audit): register the secret-usage route in the validation baseline
  
  Vikhyath Mondreti
  and
  claude
  committed
  a7539cf
- fix(secrets): keep rollup metadata with its run, and stop shadowed bindings faking usage
  
  Vikhyath Mondreti
  and
  claude
  committed
  cfc14e4
- chore(db): format the generated migration snapshot
  
  Vikhyath Mondreti
  and
  claude
  committed
  a20c61d
- fix(secrets): detect every rebinding of the environment identifier, not just declarations
  
  Vikhyath Mondreti
  and
  claude
  committed
  a7a5fff
- fix(secrets): apply the rebinding rule to shell, and say when a run's log is gone
  
  Vikhyath Mondreti
  and
  claude
  committed
  d293432
- Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail
  
  Vikhyath Mondreti
  and
  claude
  committed
  7f0c29d
- fix(secrets): writing a name is not reading it, and a bare mention is not a rebinding
  
  Vikhyath Mondreti
  and
  claude
  committed
  3998ac6
- fix(secrets): an update reads before it stores, and a del target may be parenthesized
  
  Vikhyath Mondreti
  and
  claude
  committed
  0e71127
- fix(secrets): stop excluding Python writes, which kept leaking in the unsafe direction
  
  Vikhyath Mondreti
  and
  claude
  committed
  f6c137c
- fix(secrets): report recognized reads instead of proving they are not reads
  
  Vikhyath Mondreti
  and
  claude
  committed
  edad2e8
Commits on Aug 19, 2026
- refactor(secrets): drop the last write-vs-read special case
  
  Vikhyath Mondreti
  and
  claude
  committed
  57d1217
- refactor(secrets): ship only the fields the trail actually shows
  
  Vikhyath Mondreti
  and
  claude
  committed
  1e93f40
- fix(secrets): report referenced code secrets, not only ones that surface in output
  
  Vikhyath Mondreti
  and
  claude
  committed
  ba4e194
- fix(secrets): shell escaping is backslash parity, not adjacency
  
  Vikhyath Mondreti
  and
  claude
  committed
  4e66984
- Merge remote-tracking branch 'origin/staging' into feat/secret-usage-audit-trail
  
  Vikhyath Mondreti
  and
  claude
  committed
  c00bf47
- fix(secrets): recognize destructured environment reads
  
  Vikhyath Mondreti
  and
  claude
  committed
  2ad0882
- fix(secrets): one receiver rule for destructured reads, parentheses included
  
  Vikhyath Mondreti
  and
  claude
  committed
  a040b2d
- fix(secrets): a dot in prose is not a qualifier, and a literal computed key is a subscript
  
  Vikhyath Mondreti
  and
  claude
  committed
  01fa6ca

Commits

Commits on Aug 18, 2026

Commits on Aug 19, 2026