feat(automation): a flow's credentials live in a write-only channel on the secret seam, not in its stored definition (#20790) - #21377

Merged

objectstack-fleet[bot] merged 15 commits into

mainfrom

claude/issue-20790-flow-hook-secret-seam

Oct 2, 2026

Commits on Oct 2, 2026

wip(automation): flow credentials move into a write-only channel on the secret seam
claude
committed
d3ce4eb
wip(automation): pins, docs and changeset for the flow credential channel
claude
committed
8584ba8
wip(automation): one cleared-secret guard; the metadata door's error body shape in the pin
claude
committed
c41817b
wip(automation): bound the channel's unique key; the two censuses count the new object and write sites
claude
committed
a38db79
wip(automation): a failed credential move logs at error; the test doubles meet the engine contract gates
claude
committed
699f3cf
wip(automation): dogfood aliases trigger-api to source; the protocol pin's find double refuses operators
claude
committed
457f434
Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam
claude
committed
6c67c3a
docs(automation): the projection module states where a stored flow's credentials now live
claude
committed
ff02ec5
fix(automation): the channel's table rides the run objects' manifest registration; the test crypto fake meets the provider contract
claude
committed
9cc9fdf
Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam
claude
committed
6dd8c07
test(runtime): the projection pin's clone case reads the C1 refusal of a credential-holding source
claude
committed
80b4647
docs(automation): scope the flow credential sentence to a flow saved through the metadata API; name both triggers of the one-time move
claude
committed
bd9a133
Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam
claude
committed
be755de
fix(automation): a packaged literal hook asks the credential channel only for a position it holds
claude
committed
84d3d29
Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam
claude
committed
417ba1f

Navigation Menu

feat(automation): a flow's credentials live in a write-only channel on the secret seam, not in its stored definition (#20790) - #21377

feat(automation): a flow's credentials live in a write-only channel on the secret seam, not in its stored definition (#20790)#21377
objectstack-fleet[bot] merged 15 commits into
mainfrom
claude/issue-20790-flow-hook-secret-seam

Commits on Oct 2, 2026

wip(automation): flow credentials move into a write-only channel on the secret seam

wip(automation): pins, docs and changeset for the flow credential channel

wip(automation): one cleared-secret guard; the metadata door's error body shape in the pin

wip(automation): bound the channel's unique key; the two censuses count the new object and write sites

wip(automation): a failed credential move logs at error; the test doubles meet the engine contract gates

wip(automation): dogfood aliases trigger-api to source; the protocol pin's find double refuses operators

Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam

docs(automation): the projection module states where a stored flow's credentials now live

fix(automation): the channel's table rides the run objects' manifest registration; the test crypto fake meets the provider contract

Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam

test(runtime): the projection pin's clone case reads the C1 refusal of a credential-holding source

docs(automation): scope the flow credential sentence to a flow saved through the metadata API; name both triggers of the one-time move

Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam

fix(automation): a packaged literal hook asks the credential channel only for a position it holds

Merge remote-tracking branch 'origin/main' into claude/issue-20790-flow-hook-secret-seam