root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(FN-4984): complete Step 4 - documentation updates

Browse Source 
Fusion-Task-Id: FN-4984
Fusion-Task-Lineage: 8fdf7a19-b101-4b33-8e60-44fcbf402256
This commit is contained in:
Fusion (runfusion.ai)
2026-05-18 04:31:51 -07:00
committed by gsxdsm
parent 0f6b0fb096
commit 040a9099de
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/secrets.md
View File

@@ -148,6 +148,8 @@ Envelope format is `WrappedSecretsBundle` from `packages/core/src/secrets-sync.t
Sync passphrase storage is local-only: reserved key `__sync_passphrase__` in `secrets_global` with `access_policy="deny"` and `env_exportable=false`, encrypted under the local master key. The passphrase is never transmitted and never returned by HTTP endpoints.
Dashboard UX now exposes this through SecretsView → **Cross-Node Sync Passphrase**. The panel uses `GET/PUT/DELETE /api/secrets/sync-passphrase`; the GET route returns only `{ configured: boolean }` (no plaintext readback), and the reserved `__sync_passphrase__` row is filtered from the regular `GET /api/secrets` list.
Error mapping:
- `SecretsSyncError` codes (`wrong-passphrase`, `version-mismatch`, `malformed`) return HTTP `400` with `{ "error": <code> }`.