feat(secret-store): add generic OS keyring secret store to OSS core#2

Open

GregKinne wants to merge 19 commits into

mainfrom

feat/oss-secret-store

Commits on Jul 3, 2026

feat(secret-store): add generic OS keyring secret store to OSS core
Gregory Kinne
committed
feat(secret-store): add consolidated macOS keyring backend
Gregory Kinne
committed

Commits on Jul 7, 2026

fix(secret-store): cross-platform guards + stranded-secret warning
Gregory Kinne
committed
refactor: replace os.fchmod with os.chmod for OS-agnostic fallback
Gregory Kinne
committed
Merge pull request #3 from GregKinne/fix/secret-store-cross-platform
GregKinne
authored

Commits on Jul 9, 2026

refactor: transparent chunking + three-tier fallback + configurable service name
Gregory Kinne
committed
style: apply ruff format to secret_store and tests
Gregory Kinne
committed
fix(secret-store): enforce reserved ':cp:' namespace on secret names (F9)
Gregory Kinne
committed
fix(secret-store): stop stripping secrets; reject empty values loudly (F8)
Gregory Kinne
committed
fix(secret-store): uniform fallback failure contract, surfaced to callers (F3/F4/F10)
Gregory Kinne
committed
fix(secret-store): lock fallback RMW + scrub stale plaintext on healthy set (F5/F6)
Gregory Kinne
committed
fix(secret-store): namespace the fallback file by service name (F2)
Gregory Kinne
committed
fix(secret-store): honest owner-only hardening on Windows, not false chmod (F1)
Gregory Kinne
committed
fix(secret-store): route user-facing notices through the messaging bus (F11)
Gregory Kinne
committed
fix(secret-store): generation-numbered crash-safe chunking (F7)
Gregory Kinne
committed

Commits on Jul 10, 2026

Merge pull request #4 from GregKinne/fix/pr531-review
GregKinne
authored
Merge remote-tracking branch 'mpf/main' into resolve-pyproject
Gregory Kinne
committed
scrub: genericize enterprise references in secret store backend
Gregory Kinne
committed
fix(secret_store): gate keyring write on keyring_available() to prevent null-backend silent credential loss
Gregory Kinne
committed