docs: define connector secret retirement

2026-07-21 16:00:29 +02:00
parent 492fec46b6
commit 89771d96fb
2 changed files with 7 additions and 1 deletions
--- a/docs/REFERENCE_JOURNEY_PROGRAM.md
+++ b/docs/REFERENCE_JOURNEY_PROGRAM.md
@@ -47,7 +47,10 @@ journey needs and supplies contracts shared by all five stages.
   source-of-truth mode, capabilities, health, limits, credential references,
   and lifecycle. Network destinations are resolved and pinned at connection
   time; private-network access is deployment-controlled and unpinned private
-   transports fail closed.
+   transports fail closed. Deleting a connector or provider immediately
+   deletes every secret it owns and records a non-secret audit event in the
+   same lifecycle action; an unavailable external secret provider blocks the
+   deletion or retirement rather than leaving an unaudited orphan.
 2. **External effects.** Requested action, durable command, observed effect,
   unknown outcome, retry, reconciliation, compensation/correction, and manual
   intervention remain distinct and auditable.