Repository navigation
S3 — Keychain secrets by reference #2251
Description
Slice
Store an API key with min secret, reference it in a box spec, and the box's requests to its upstream carry it while the key never enters the box.
Tasks:
- T25 — Read client-owned store rules and refuse rules in the deny set #2280 — Read client-owned store rules and refuse rules in the deny set
- T26 — Store, list and remove secrets with min secret under proxy-only access #2287 — Store, list and remove secrets with min secret under proxy-only access
- T39 — Write the store rule from min secret set, with fixed-token presets #2325 — Write the store rule from min secret set, with fixed-token presets
- T27 — Mint store handles and keep the client's key registered across proxy restarts #2288 — Mint store handles and keep the client's key registered across proxy restarts
- T28 — Inject a stored key in the registered form, read from the Keychain per request #2292 — Inject a stored key in the registered form, read from the Keychain per request
- T29 — Keychain secrets by reference, end to end #2294 — Keychain secrets by reference, end to end
Spikes:
- SP1 — Do Claude Code and an MCP client send a sealed handle unmodified? #2257 — Do Claude Code and an MCP client send a sealed handle unmodified?
Activity