Loading srm/interface-contract.md +15 −0 Changes for srm/interface-contract.md: 15 added lines, 0 removed lines. Original line number Diff line number Diff line Loading @@ -107,6 +107,21 @@ contract only. It is distinct from the canonical JSONB shape identifiers (`srm.p `srm.compute/v1`, `srm.result/v1`) carried inside payloads, which version those shapes independently (see [srm/canonical-parameters-schema.md](/srm/canonical-parameters-schema.md)). **No raw credentials in command payloads.** SRM writes a frozen copy of every accepted command to `service_order.payload_snapshot` (Persistence Model §B.4), so whatever a publisher sends is retained for the life of the order. Publishers therefore carry credentials as `secret://` references only — never a raw token, password, or key — consistent with the rule that raw secret values are never persisted ([srm/persistence-model.md](/srm/persistence-model.md), Data protection). This is a publisher obligation: SRM does not redact, because `payload_snapshot` is deliberately a full copy and a redaction list would have to anticipate field names that do not exist yet. Two categories are excluded from payloads entirely rather than referenced. **Adapter and backend credentials** are never a payload concern — they live in the runtime ControlPathRegistry (ADR-0004). **App-provider callback credentials** (CAMARA `sinkCredential`, `notificationAuthToken`) are OEG-owned state that never crosses into a `command.srm.*` payload (§C.4, ADR-0008). ### B.2 `command.srm.service.deploy` — `SrmServiceDeployV1` Top-level (envelope +): Loading Loading
srm/interface-contract.md +15 −0 Changes for srm/interface-contract.md: 15 added lines, 0 removed lines. Original line number Diff line number Diff line Loading @@ -107,6 +107,21 @@ contract only. It is distinct from the canonical JSONB shape identifiers (`srm.p `srm.compute/v1`, `srm.result/v1`) carried inside payloads, which version those shapes independently (see [srm/canonical-parameters-schema.md](/srm/canonical-parameters-schema.md)). **No raw credentials in command payloads.** SRM writes a frozen copy of every accepted command to `service_order.payload_snapshot` (Persistence Model §B.4), so whatever a publisher sends is retained for the life of the order. Publishers therefore carry credentials as `secret://` references only — never a raw token, password, or key — consistent with the rule that raw secret values are never persisted ([srm/persistence-model.md](/srm/persistence-model.md), Data protection). This is a publisher obligation: SRM does not redact, because `payload_snapshot` is deliberately a full copy and a redaction list would have to anticipate field names that do not exist yet. Two categories are excluded from payloads entirely rather than referenced. **Adapter and backend credentials** are never a payload concern — they live in the runtime ControlPathRegistry (ADR-0004). **App-provider callback credentials** (CAMARA `sinkCredential`, `notificationAuthToken`) are OEG-owned state that never crosses into a `command.srm.*` payload (§C.4, ADR-0008). ### B.2 `command.srm.service.deploy` — `SrmServiceDeployV1` Top-level (envelope +): Loading
