feat(config): fail-closed manifest-driven injection + runtime write-back delivery (D6)

2026-08-31 09:43:43 +01:00
parent a9e2182396
commit c540ad5d7f
6 changed files with 326 additions and 16 deletions
@@ -987,7 +987,9 @@ paths:
        stored plaintext (read-write); password fields are AES-256-GCM
        encrypted at rest, keyed by <dataRoot>/maestro/secrets.key, and never
        returned again — the response is only a ServiceConfigEntry with set:true.
-        The value is injected as the field's env key on the next start.
+        The value is injected as the field's env key at start, and, when the
+        service is running and exposes POST /config (D6 write-back), delivered
+        to it at runtime over the mTLS peer edge.
      requestBody:
        required: true
        content: