Release Notes v0.1.0¶

Released: 2026-11-01

Highlights¶

The first release of systemspec-credential: a registry of the credentials a set of systems needs, without their values, and an event log of what happened to each. From the two, credspec works out what to do next and what is due, and writes it out for people.

One validated registry. Every secret, key, token, certificate and account: what it is for, how and where it is made, what it may do, where it is stored, who uses it, who handles it and how it rotates. Write it in JSON or build it in Go; both pass the same validation, and the JSON Schemas are generated from the Go types.
What to do next. Each credential is to-create, to-record, to-deploy or deployed, with its next step: the console or command that makes it, and how to install it in each store.
What is due. A lifecycle state from the rotation policy and the events, and a status command that fails a deploy when anything is expired or overdue.
Reports for people. A self-contained HTML report, a management plan with the launch checklist and the rotation calendar, an iCalendar export and a Markdown reference for documentation sites.

The Registry¶

Each entry describes one credential in one place for one environment.

Where it comes from: the issuer and its console, and the generation method (random, keypair, issued, derived or federated) with the command or console steps.
Where it lives: each store with its role (primary, backup or rendered), path, console, and how the value is installed there.
Who uses it and what it may do: consumers, entitlements, what a holder can do and how to revoke it.
Rotation: scheduled, on-expiry or on-demand, with the procedure and its impact.
Handling: whether a person or a system generates, distributes and rotates it. Every report counts what needs you by hand.
Reach: dependsOn and reaches link credentials, so each shows what its leak exposes, directly or through others, and which credentials expose it.
Accounts: a person's login that controls other credentials, with its protections and recovery.

See The Registry.

Events, Work and States¶

credspec record adds created, rotated, expires, deployed, verified and revoked events, for one credential or every one matching a * pattern. From them come each credential's work progress and its lifecycle state: ok, due, overdue, expiring, expired, unknown-expiry, unrecorded, planned or retired.

See Events, Work and States.

Reports¶

Format	For
`html`	Browsing: search, filters, details, shareable filtered views, CSV
`plan`	Doing: the launch checklist in dependency order, what to record and deploy, the rotation calendar, account protections, exposure
`ics`	Remembering: every rotation and expiry with a reminder, stable across re-imports
`markdown`	Documentation: a reference that depends only on the registry
`json`	Other tools

Time-dependent reports record their as-of date, read back by report.AsOf, so a test can check a committed copy is current. See Reports.

Packages¶

Package	Purpose
`credspec`	Types, validation, event log, states, progress, reach
`report`	The reports
`schema`	The generated JSON Schemas, embedded
`cli`	The commands, mountable in your own Cobra tool
`cmd/credspec`	The standalone command

credspec and report depend only on the standard library and oscompat. Files are written atomically, and the same code is correct on Linux, macOS and Windows. See Using It from Go.

Installation¶

go install github.com/plexusone/systemspec-credential/cmd/[email protected]

or, as a library:

go get github.com/plexusone/[email protected]

Compatibility¶

This is the first release. The registry and event log formats are at formatVersion 1; a change that breaks existing files will change that version.

Documentation¶

A MkDocs site with guides to getting started, the registry, events and states, reports and use from Go.
The product and technical requirements, the plan and the roadmap under Design.