Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

docs: consolidate design documentation and standardize crate English

Browse Source
This commit is contained in:
Hare
2026-10-12 14:58:00 +09:00
parent a633a53274
commit 4efb0ace1f
404 changed files with 4556 additions and 11654 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/secrets/README.md
+5 -26
View File
@@ -1,30 +1,9 @@
# secrets
## Role
Local store retrieving secrets by provider-independent logical IDs. It owns the storage format and validation that keep secrets out of scattered configuration files, not provider-specific authentication protocols or caller logging controls.
`secrets` provides the local secret reference store used by provider and tool configuration.
## Main entry points
## Boundaries
Owns:
- provider-independent secret id to value lookup
- modest plaintext-at-rest reduction and integrity checks
- secret store file format and validation
Does not own:
- provider-specific auth protocol (`provider`)
- Codex OAuth local integration shape (`provider`)
- prompting or model context
- work item or diagnostic redaction policy outside its API surface
## Design notes
The store is not a high-assurance keychain. It exists to avoid scattering plaintext credentials through config files and logs, not to provide strong local adversary protection.
Secret values must stay out of diagnostics, Debug output, CLI/TUI output, work items, docs, session logs, model context, and persisted plaintext files.
## See also
- [`../../docs/design/provider-model-boundary.md`](../../docs/design/provider-model-boundary.md)
- [`SecretId`] — logical ID validation
- [`SecretValue`] — secret values with redacted Debug output
- [`SecretStore`] — local storage, integrity checks, and protection limits