Enum CredentialRef 

pub enum CredentialRef {
    Path(SecretPath),
    Sentinel(String),
}

What a source needs to be operational.

Per ADR-021 §4: a Vault source needs a Vault token, a 1Password source needs a signed-in account session, etc. The credential reference is either:

• A path under the reserved __sources/ namespace pointing at the credential value in the credential store, or
• A source-defined sentinel string (biometric, default-profile, oauth) that the source plugin interprets itself.

The router uses this on configuration load to enforce the recursion invariant (P5.5): a source-credential must resolve through a source whose own SecretSource::requires_credential is None. That’s why this enum exists — sources need a way to say “my credential lives at this path” or “my credential lives inside me; ask my native unlock”. Without the distinction the recursion check would reject 1Password’s biometric session as a missing credential.

Variants

Path(SecretPath)

A path under the reserved __sources/ namespace. The router fetches the value from the credential store and hands it to the source’s init step.

Sentinel(String)

A source-specific sentinel like biometric or default-profile. Opaque to the router; meaningful only to the source plugin.

Trait Implementations

impl Clone for CredentialRef

fn clone(&self) -> CredentialRef

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialRef

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CredentialRef

impl PartialEq for CredentialRef

fn eq(&self, other: &CredentialRef) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for CredentialRef