apiVersion: railiance.fabric/v1alpha1
kind: BindingAssertion
metadata:
  id: artifact-store.object-storage.runtime-secrets-to-openbao
  name: artifact-store runtime secrets binding
  owner: artifact-store
  repo: artifact-store
  domain: railiance
spec:
  lifecycle: planned
  environments: [dev, staging, prod]
  dependency_id: artifact-store.object-storage.needs-runtime-secrets
  provider_capability_id: railiance-platform.openbao.runtime-secrets
  provider_interface_id: railiance-platform.openbao.kv-v2
  status: compatible
  rationale: Planned object-storage credential vending should use OpenBao for protected runtime secrets.