From 89771d96fbcf115ca5eabf6850d120d90e1f1737 Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 21 Jul 2026 16:00:29 +0200 Subject: [PATCH] docs: define connector secret retirement --- docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md | 3 +++ docs/REFERENCE_JOURNEY_PROGRAM.md | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md b/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md index a6e0fdb..ea65474 100644 --- a/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md +++ b/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md @@ -1012,6 +1012,9 @@ Priorities: contracts from proven Campaign and Calendar behavior. 4. Implement connector inventory/profiles, source-of-truth declarations, health, secret references, webhooks/polling evidence, and lifecycle. + Connector/provider deletion and destructive module retirement immediately + remove provider-owned secrets and emit non-secret audit evidence; failed + external-secret deletion fails closed. 5. Let modules contribute object regions, actions, work items, and focused-view fragments through Core without optional sibling imports. 6. Expand configuration-package providers, dry-run, apply, export, upgrade, diff --git a/docs/REFERENCE_JOURNEY_PROGRAM.md b/docs/REFERENCE_JOURNEY_PROGRAM.md index 81b08da..b3bb086 100644 --- a/docs/REFERENCE_JOURNEY_PROGRAM.md +++ b/docs/REFERENCE_JOURNEY_PROGRAM.md @@ -47,7 +47,10 @@ journey needs and supplies contracts shared by all five stages. source-of-truth mode, capabilities, health, limits, credential references, and lifecycle. Network destinations are resolved and pinned at connection time; private-network access is deployment-controlled and unpinned private - transports fail closed. + transports fail closed. Deleting a connector or provider immediately + deletes every secret it owns and records a non-secret audit event in the + same lifecycle action; an unavailable external secret provider blocks the + deletion or retirement rather than leaving an unaudited orphan. 2. **External effects.** Requested action, durable command, observed effect, unknown outcome, retry, reconciliation, compensation/correction, and manual intervention remain distinct and auditable.