Vault Explorer
Phase IV · V1 — Given an authorized execution plan, how are secrets represented and released without exposing their values to anything? References only: no value field exists in any contract, no backend is connected, no material is ever released here. Inspection-only.
The Universal Vault owns secret custody contracts — identity, classification, scope, versions, rotation, revocation, release eligibility, leases, and value-free audit — as the sole authority. One-Way Secret Law: every layer may carry a SecretRef; none may carry a value, and no value-bearing field exists in any public contract (the structural guarantee), reinforced by a deterministic credential-shape redaction scanner (defense-in-depth). Backends (HashiCorp/AWS/Keychain/…) are declared future adapters — none connected, no SDK imported. Release decisions are eligibility metadata: a decision is not a lease and not permission to execute. Value materialization is owned by the future Broker chain (V3–V4) at the final protected boundary, behind binding Policy allow and V2 Approval.