ESS specification
Secrets is specified in ESS. This page and the domain pages below are generated from the repository's spec/ directory by secrets-docs: the graphs from ess specify compile, the pages from ess generate --kind docs. They change when the specification changes, and task check fails if they fall behind it.
custody is retrofitted from the shipped service and every declaration cites its source; a conformance suite runs it against the real HTTP router and PostgreSQL store. storage is the model of named, scoped secrets over several backends; secrets-core implements its storage port, and a second suite runs that in process. No backend implements it yet.
custody
Encrypted, tenant-scoped custody of secret values, their revocation and deletion, and atomic prepared mutation batches.
ESS domain · secrets.custody
Encrypted, tenant-scoped custody of secret values, their revocation and deletion, and atomic prepared mutation batches.
- Entities2
- One
- Many
- Initial state
Hover or focus an entity to see its fields, lifecycle and relations. Press Enter to pin it, Escape to clear.
Lifecycles with transitions
SecretDomain as text
| Entity | Identity and fields | Lifecycle | Relations |
|---|---|---|---|
PreparedTransaction | transaction: uuid (identity) tenant: string actor: string mutations: List<Mutation> created_at: string expires_at: string | states Prepared; initial Prepared | — |
Secret | reference: Reference (identity) id: uuid owner_subject: string disclosure: Disclosure version: integer labels: Map<string, string> value: bytes created_at: string updated_at: string | states Active, Revoked; initial Active revoke: Active or Revoked → Revoked replace: Active or Revoked → Active | — |
Source: generated by secrets-docs from spec/ (ess specify compile); do not edit
Read the custody domain in full
storage
Named, scoped secrets stored through exactly one backend per namespace, with every command decided by an authorizer before any backend call.
ESS domain · secrets.storage
Named, scoped secrets stored through exactly one backend per namespace, with every command decided by an authorizer before any backend call.
- Entities5
- Owns
- References
- One
- Many
- Initial state
Hover or focus an entity to see its fields, lifecycle and relations. Press Enter to pin it, Escape to clear.
Domain as text
| Entity | Identity and fields | Lifecycle | Relations |
|---|---|---|---|
Backend | backend: BackendRef (identity) capabilities: List<Capability> | states Present; initial Present | — |
Binding | address: Address (identity) locator: string namespace: NamespaceKey | states Present; initial Present | — |
Namespace | namespace: NamespaceKey (identity) mount: Optional<BackendRef> tenant: ScopeName | states Present; initial Present | mount references one Backend bindings owns many Binding |
Secret | address: Address (identity) version: Optional<string> namespace: NamespaceKey | states Stored; initial Stored | namespace references one Namespace |
Tenant | tenant: ScopeName (identity) | states Present; initial Present | namespaces owns many Namespace |
Source: generated by secrets-docs from spec/ (ess specify compile); do not edit