Deliver every secret through VSO, as env or file #378

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

An Application author gets one secret delivery path. A secret arrives as environment variables or as files, synced by the Vault Secrets Operator, and a rotation restarts the Process. This is the one addition the contract's narrowing of self depends on, so it lands before the contract pull request. Decided in Decide how the model meets the live needs no chapter covers (items 5 and 6) and Decide which conditions on the settled decisions change the model (decisions 10 and 11).

Acceptance criteria

• delivery: file renders a synced Secret mounted as files, and delivery: env a synced Secret read as environment.
• A database credential an edge derives is delivered as a dynamic secret, as env or file, and the chapters that describe it agree.
• Every rendered static secret polls at one derived interval of 10 minutes, carries the setting a restart needs, and names its consuming workload as a restart target. Nothing is authored.
• No Vault Agent injector annotation is rendered anywhere.
• Chapter 17 states that no Vault token is delivered: an Application that talks to Vault itself takes the self path and logs in with its service account.
• self is still accepted as before; its narrowing waits for the contract pull request. 0030 is rewritten in place.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• None. Neither the compiler split (Split the compiler's mixed modules by concept, with no change of behaviour #376) nor chapter 00 (Rewrite chapter 00 and the premise: goals, non-goals, purpose and scale #377) is needed to deliver a dynamic secret through VSO, so this no longer waits on them (decided in Create every per-Project secret in the cluster: generated keys, database credentials and OIDC clients #444).