Runtime SDL: define observed-value and credential posture invariants

[Brad-Edwards]

Problem

The current runtime SDL has many places that describe observed runtime values, settings, sensitivity/redaction state, provenance, and credential posture. These concepts appear across service-family inventory surfaces such as database, DNS, mail, security monitoring, identity, datastore, platform application, forwarding agents, application authorization, filesystem, environment variables, mounts, and application exposure metadata.

The model needs a current-state design pass that answers which similarities are true shared semantics and which differences are domain-specific constraints. The goal is a coherent SDL contract for observed values and credentials, not mechanical consolidation.

First-principles questions

• What runtime facts are generic observed key/value settings?
• Which facts are scoped settings with additional domain structure, such as component refs, setting ids, scopes, or redaction labels?
• Which facts are not settings at all, but identity attributes, exposed fields, mount/path sensitivities, credential posture, or credential strength?
• Which provenance concepts are shared, and which family-specific provenance distinctions must be preserved?
• Which redaction and raw-value omission rules must hold across all current runtime surfaces?
• Which credential classifications describe secret presence/posture, and which describe credential strength or quality?
• What should be enforced by shared helpers, shared base models, family-specific models, generated schema constraints, and semantic validation?

Expected outcome

Produce and implement a current SDL design that makes observed-value and credential handling reviewable across the runtime surface.

The design may choose shared primitives, shared validators, constrained subclasses, family-specific models, schema aliases, semantic validators, or a combination. It must not assume that fields with similar names necessarily represent the same concept.

Acceptance criteria

• Inventory every current runtime surface that carries observed values, settings, sensitivity/redaction state, provenance, credential posture, or credential strength.
• Classify each surface by semantic concept and document why it is shared or intentionally family-specific.
• Define cross-surface invariants for raw-value omission, secret-bearing names, sensitivity/redaction classifications, credential posture, credential strength, provenance, and enum openness/closedness.
• Implement the chosen model without erasing required family-specific constraints such as stable ids, component refs, scopes, multi-valued identity attributes, closed redaction lattices, or source/evidence fields.
• Keep or add shared helpers only where the semantics are actually shared.
• Regenerate SDL schemas if model shape changes.
• Update SDL documentation and ADR coverage for the chosen design.
• Add regression tests that prove both the shared invariants and the intentionally preserved family-specific differences.
• Validate affected example scenarios against the updated SDL and confirm no observed fact is dropped, weakened, or silently reclassified.