apiVersion: railiance.fabric/v1alpha1
kind: BindingAssertion
metadata:
  id: railiance-forge.source-forge.runtime-secrets-to-openbao
  name: Forge runtime secrets binding
  owner: railiance-forge
  repo: railiance-forge
  domain: railiance
spec:
  lifecycle: active
  environments: [dev, staging, prod]
  dependency_id: railiance-forge.source-forge.needs-runtime-secrets
  provider_capability_id: railiance-platform.openbao.runtime-secrets
  provider_interface_id: railiance-platform.openbao.kv-v2
  status: compatible
  rationale: Runtime secret custody for forge workloads belongs to the platform OpenBao path; SOPS/age remains bootstrap only.