Verify deployment readiness for context-derived secret bindings #1479

Scope

Track deployment validation for the context-derived credential bindings implemented in #1453 for #1037. Application regressions and local native-runtime tests are separate from provider and deployment evidence. This checklist gates production rollout, not the config-only attacker fix's implementation.

Use fictional credentials and isolated resources. Do not read or provision production application credentials for these rehearsals. Record the tested revision, runtime/provider version, resource identifiers, principal, operation, expected result, actual result, and sanitized evidence.

Release checklist

• Review/accept the EdgeZero prerequisite in Support implicit credential lookup plans and shared Fastly secret operations edgezero#444 and agree the production dependency pin. The implementation currently pins published commit 4f645b1e705d295117c93f4c74db12e5692ffb34.
• Verify the actual config-publisher principal can publish config but cannot read/write native credentials, authorize new bindings, change deployment mappings/executables, or run unreviewed code with provisioning credentials. Follow docs/guide/secrets.md permission matrix.
• Verify isolated Fastly create/replace/read-through using the reviewed plan and exact provider IDs. Record stored-byte preservation, propagation, name/value limits, uncertain-write reconciliation, and required runtime refresh. Verify the documented native provisioning paths on the other deployment targets.
• Rehearse protected provisioning CI with independent approval and immutable CLI/config inputs. Confirm rejected plan/resource changes cause no prompt or mutation and credentials never appear in argv, output, or artifacts.
• Rehearse compatible old/new config isolation and production-style state reconstruction. Cover same-context rotation, coordinated multi-key S3 replacement, context retirement, fresh-state retired-config replay rejection, retained/in-flight snapshots, and the documented unsafe-downgrade procedure.
• Record deployment-specific credential-bearing HTTPS checks, including S3 preflights and retained-state behavior, where deployed trust stores or provider behavior differ from the local runtime fixtures. Do not claim local tests certify a provider environment or immediate revocation of retained snapshots.

References

• TESTING.md, secret-binding evidence boundaries
• docs/guide/secrets.md
• docs/guide/secrets-ci.md
• docs/guide/secret-binding-migration.md

Closing #1037 does not authorize a production rollout or claim that this checklist has passed.