feat(cli,service-settings): os secret rewrap, the at-rest re-wrap of version-1 sys_secret ciphertext under each holder's producer scope (ADR-0128 §4.2, stage 2) - #21469

Merged

objectstack-fleet[bot] merged 9 commits into

mainfrom

claude/issue-21326-at-rest-rewrap

Oct 2, 2026

Commits on Oct 2, 2026

feat(service-settings): publish ciphertextDerivationStatus, the provider's own reading of a stored ciphertext's AAD derivation (ADR-0128 §4.2)
claude
committed
32c3aa0
feat(cli): os secret rewrap, the at-rest re-wrap of version-1 sys_secret ciphertext (ADR-0128 §4.2)
claude
committed
4c8d2fa
test(cli): pin the re-wrap's attribution, resumability, live-safety, fail-closed and verify-before-write (ADR-0128 §4.2)
claude
committed
9d9fd6d
test(cli): pass an unanswered datasource declaration through as undefined in the re-wrap pins
claude
committed
2ddee01
test(cli): os secret rewrap guards and its concrete-driver contract (ADR-0128 §4.2)
claude
committed
202fb29
fix(cli): os secret rewrap boots the orphans composition and resolves its key before the boot
claude
committed
5015d0d
feat(cli): os secret rewrap hands the composed settings service its own provider, so no provider in the run mints a key; join the bootSchemaStack families
claude
committed
3200804
docs(cli): os secret rewrap reference; changeset and ADR-0128 anchor for the re-wrap
claude
committed
6a7c27c
fix(changeset): os secret rewrap declares Clause-② yes (widening)
claude
committed
219457c