security: encrypt credentials at rest, publish the posture page, and release 0.10.0 (Phase 3) - #324

Merged

cevheri merged 12 commits into

mainfrom

security/phase-3-credentials-at-rest

Aug 10, 2026

Commits on Aug 10, 2026

feat(storage): add the versioned credential envelope and its derived key
cevheri
committed
32ac2cf
feat(storage): classify every connection field and seal the six credential-bearing ones
cevheri
committed
0ed0518
feat(storage): encrypt credentials at rest above the provider boundary
cevheri
committed
05e1515
docs(storage): state what credential encryption at rest does, and what rotating the key costs
cevheri
committed
29d34c9
docs(security): publish the control inventory as a posture page
cevheri
committed
3d0c5b5
feat(security): fail the build when the posture page drifts from the repository
cevheri
committed
6564e71
chore(release): 0.10.0 - credential encryption at rest and the security posture page
cevheri
committed
387dd57
fix(storage): seal a credential shaped like an envelope on write, not pass it through
cevheri
committed
287d48d
fix(security): require a Verified by link to be a test, and catch duplicate control ids
cevheri
committed
abdafbd
chore(chart): mark the 0.10.0 release as containing security updates
cevheri
committed
3a0bdcf
docs(security): scope the backup/volume-snapshot claim to when it actually holds
cevheri
committed
ad06913
fix(security): a real verifier for the choke point, a fixed Helm alias, and test isolation
cevheri
committed
dea4f0b