[highb]

Squire (openai/gpt-6.1-sol):

Add straightforward JSON builders for the existing Multipass credential formats. This PR is stacked on #1192; #1195 carries the combined native-input/output tip for C1.

pkg/secretcontracts provides password, API-key, SSH-key, OAuth-client-secret and certificate structs with the existing JSON field names. Their Encode methods return JSON bytes and the corresponding content type. EncodeJSON also supports custom fields/types; EncodeText preserves text bytes. These are serializers: empty values, unfamiliar types and values that do not match a receiver schema are not rejected here. Ordinary JSON serialization errors are returned.

Type provenance and synchronization

Multipass owns these document formats. The Go builders mirror the content-type identifiers, JSON field names and scalar/list shapes in its canonical type catalog. The source snapshot used for this reference is pinned in the links below:

Go builder	Multipass definition
PasswordV2	password_v2
APIKeyV2	api_key_v2
SSHKey	ssh_key
OAuthClientSecretV2	oauth_client_secret_v2
Certificate	certificate

The Multipass codec defines document encoding/decoding; the separate value-envelope implementation sets content_type and envelope_version. These builders produce the inner document bytes, not that envelope.

When changing a builder, compare its JSON tags, Go field types and collection shapes with the corresponding Multipass definition and codec, update the serialization tests, and refresh these pinned references to the source actually checked. In particular, OAuth redirect_uri is a list despite its singular JSON name. Multipass documents that deployed content-type layouts are frozen; incompatible layouts require a new content-type identifier. This PR does not add automatic cross-repository drift checks or copy Multipass's semantic validation rules into Baton.

Use the existing delivery metadata and encodings: bare JSON fields, content_type, and the existing SecretPayloadV2 envelope version. No new JSON wrapper, crypto format or admission policy is introduced.

This replaces the earlier copied schemas/catalog, semantic validators, producer/stored validation APIs, parity fixtures, update scripts and JSON Schema dependency. The superseded Multipass #975 is closed and is no longer a dependency. Multipass owns its existing rendering and error behavior; strict cross-repository payload matching is not required.

Validation on the combined tip: six affected SDK packages pass tests/build/vet; affected lint passes with the CI-pinned tool; protobuf build/lint/format and breaking checks against the exact current upstream revision pass. Root independently ran uncached builder and connector-builder tests. Tests cover existing field names, type metadata, JSON escaping/Unicode, empty and otherwise schema-invalid values, custom fields/types, serialization errors and text-byte preservation. Historical broader checks retain their original revisions; the unrelated prior uhttp lint baseline is not waived.

Request-input validation, selected-output identity, recipient/AAD/authentication and encryption checks remain separate and unchanged. No live provider, merge, release or deployment acceptance is claimed.

[github-actions]

Superseded — see the current review report for commit ca22e2203134

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new, self-contained pkg/secretcontracts package and nothing else. It has typed structs (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods json.Marshal the struct and return a Payload{ContentType, Bytes}. It also has a generic EncodeJSON that passes marshal errors through and an EncodeText that copies the bytes unchanged. No existing code is modified, so the exported API change is additive only.

I scanned the full PR diff (5 new files, no go.mod/go.sum changes) for security and correctness issues. The content-type constants all match the existing secretContentTypePattern (^[a-z0-9]+([._-][a-z0-9]+)*$) in pkg/actions/secret_content_type.go:16, and generic matches the literal that file already uses. The PR body says the builders deliberately skip validation, and the code matches that. No repo-local criteria loaded, so the base criteria and the SDK-compatibility criteria were applied.

Coverage gap: I could not check that the JSON field names (for example redirect_uri for RedirectURIs) match the external Multipass schemas, because those schemas are not in this repo. The tests pin the current names.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

Superseded — see the current review report for commit 3daf33f172aa

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new, self-contained pkg/secretcontracts package and nothing else. It has typed structs (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods json.Marshal the struct and return a Payload{ContentType, Bytes}. It also has a generic EncodeJSON that passes marshal errors through and an EncodeText that copies the bytes unchanged. No existing code is modified, so the exported API change is additive only.

I scanned the full PR diff (5 new files, no go.mod/go.sum changes) for security and correctness issues. The content-type constants all match the existing secretContentTypePattern (^[a-z0-9]+([._-][a-z0-9]+)*$) in pkg/actions/secret_content_type.go:16, and generic matches the literal that file already uses. The PR body says the builders deliberately skip validation, and the code matches that. No repo-local criteria loaded, so the base criteria and the SDK-compatibility criteria were applied.

Coverage gap: I could not check that the JSON field names (for example redirect_uri for RedirectURIs) match the external Multipass schemas, because those schemas are not in this repo. The tests pin the current names.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

---

Reviewed commit: ca22e2203134

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit 3daf33f172aa

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: incremental since ca22e22
View review run

Review Summary

The PR adds a new pkg/secret package. It contains plain JSON builders (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate), content-type ID constants, and the generic EncodeJSON and EncodeText helpers. The new commits rename the package from pkg/secretcontracts to pkg/secret with no logic changes. They also replace the struct doc comments with pinned links to the matching Multipass definitions and codec. I scanned the full PR diff (5 new files, about 190 lines) for security and correctness. Marshal errors are returned, not swallowed. Nothing logs or exposes the secret values, and no imports or callers of the old secretcontracts path remain. No repo-local criteria loaded, so I applied only the base criteria and the SDK-compatibility criteria. Since the package is new, it can't break existing callers. I did not check the field names against the external Multipass repo; I only compared them with the PR's stated mapping. The diff metadata reports no dropped or truncated paths.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (low severity, documentation, high confidence): The PR description still says pkg/secretcontracts` provides password, API-key, …, but this push renamed the package to pkg/secret (pkg/secret/doc.go:4). Update the description so reviewers and downstream connector authors importing from the stacked PRs (IGA-4093: Bind native credential inputs and typed outputs #1195) use the right import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In the PR description (relates to `pkg/secret/doc.go`):
- Around line 4: The package was renamed from `secretcontracts` to `secret` (path `pkg/secret`), but the PR body still refers to `pkg/secretcontracts`. Update the PR description, and any stacked PR (#1195) references, to the new import path `github.com/conductorone/baton-sdk/pkg/secret`.

[github-actions]

Superseded — see the current review report for commit cf2538c27bb3

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: incremental since ca22e22
View review run

Review Summary

The PR adds a new pkg/secret package. It contains plain JSON builders (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate), content-type ID constants, and the generic EncodeJSON and EncodeText helpers. The new commits rename the package from pkg/secretcontracts to pkg/secret with no logic changes. They also replace the struct doc comments with pinned links to the matching Multipass definitions and codec. I scanned the full PR diff (5 new files, about 190 lines) for security and correctness. Marshal errors are returned, not swallowed. Nothing logs or exposes the secret values, and no imports or callers of the old secretcontracts path remain. No repo-local criteria loaded, so I applied only the base criteria and the SDK-compatibility criteria. Since the package is new, it can't break existing callers. I did not check the field names against the external Multipass repo; I only compared them with the PR's stated mapping. The diff metadata reports no dropped or truncated paths.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (low severity, documentation, high confidence): The PR description still says pkg/secretcontracts` provides password, API-key, …, but this push renamed the package to pkg/secret (pkg/secret/doc.go:4). Update the description so reviewers and downstream connector authors importing from the stacked PRs (IGA-4093: Bind native credential inputs and typed outputs #1195) use the right import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In the PR description (relates to `pkg/secret/doc.go`):
- Around line 4: The package was renamed from `secretcontracts` to `secret` (path `pkg/secret`), but the PR body still refers to `pkg/secretcontracts`. Update the PR description, and any stacked PR (#1195) references, to the new import path `github.com/conductorone/baton-sdk/pkg/secret`.

---

Reviewed commit: 3daf33f172aa

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit cf2538c27bb3

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new package, pkg/secret. It has five typed structs (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods call json.Marshal and return a Payload{ContentType, Bytes}. It also adds a general EncodeJSON and a pass-through EncodeText, plus content-type ID constants. Nothing in the repo imports the package yet, so no existing caller or exported API changes. I scanned the full PR diff (5 new files) for security and correctness issues and found none: encodeJSON returns its errors instead of dropping them, nothing is logged, and there's no unbounded processing beyond what the caller passes in. The tests cover field names, content types, escaping and Unicode, empty values, custom types, marshal failures and byte-for-byte text preservation. No repo-local criteria loaded, so I applied only the base and SDK-compatibility criteria. I didn't check the JSON tags against the external Multipass definitions because those links point outside this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still says pkg/secretcontracts, but the package is pkg/secret (pkg/secret/doc.go:4). Connector authors working from this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

[github-actions]

Superseded — see the current review report for commit 827bca4ef3d6

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new package, pkg/secret. It has five typed structs (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods call json.Marshal and return a Payload{ContentType, Bytes}. It also adds a general EncodeJSON and a pass-through EncodeText, plus content-type ID constants. Nothing in the repo imports the package yet, so no existing caller or exported API changes. I scanned the full PR diff (5 new files) for security and correctness issues and found none: encodeJSON returns its errors instead of dropping them, nothing is logged, and there's no unbounded processing beyond what the caller passes in. The tests cover field names, content types, escaping and Unicode, empty values, custom types, marshal failures and byte-for-byte text preservation. No repo-local criteria loaded, so I applied only the base and SDK-compatibility criteria. I didn't check the JSON tags against the external Multipass definitions because those links point outside this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still says pkg/secretcontracts, but the package is pkg/secret (pkg/secret/doc.go:4). Connector authors working from this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

---

Reviewed commit: cf2538c27bb3

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit 827bca4ef3d6

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new, self-contained pkg/secret package (5 files, about 190 lines). It has PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2 and Certificate structs, whose Encode() methods json.Marshal the struct and pair it with a content-type ID. It also has the generic EncodeJSON / EncodeText helpers and content-type constants. No existing code is changed and no dependencies change (no go.mod/go.sum edits). I scanned the full PR diff for security and correctness. Errors from json.Marshal are returned, nothing is logged, and nothing is validated, which matches what the PR description says. The tests cover field names, list shapes (including redirect_uri as a list), escaping, empty values and serialization errors. No repo-local criteria loaded, so only the base criteria were applied.

Coverage gap: I could not check the JSON tags against the pinned Multipass definitions.rs because that private repo is not reachable from this run. The field mapping was reviewed for internal consistency and against the PR description only.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still calls the package pkg/secretcontracts, but it is pkg/secret (pkg/secret/doc.go:4). There are no secretcontracts references anywhere in the tree. Connector authors who follow this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

[github-actions]

Superseded — see the current review report for commit cea69d517c75

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new, self-contained pkg/secret package (5 files, about 190 lines). It has PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2 and Certificate structs, whose Encode() methods json.Marshal the struct and pair it with a content-type ID. It also has the generic EncodeJSON / EncodeText helpers and content-type constants. No existing code is changed and no dependencies change (no go.mod/go.sum edits). I scanned the full PR diff for security and correctness. Errors from json.Marshal are returned, nothing is logged, and nothing is validated, which matches what the PR description says. The tests cover field names, list shapes (including redirect_uri as a list), escaping, empty values and serialization errors. No repo-local criteria loaded, so only the base criteria were applied.

Coverage gap: I could not check the JSON tags against the pinned Multipass definitions.rs because that private repo is not reachable from this run. The field mapping was reviewed for internal consistency and against the PR description only.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still calls the package pkg/secretcontracts, but it is pkg/secret (pkg/secret/doc.go:4). There are no secretcontracts references anywhere in the tree. Connector authors who follow this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

---

Reviewed commit: 827bca4ef3d6

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit cea69d517c75

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new standalone package, pkg/secret. It has five structs with JSON tags (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods call json.Marshal and return a Payload{ContentType, Bytes}. It also adds a generic EncodeJSON/EncodeText pair, content-type constants and table-driven serialization tests. I scanned the full PR diff, which is five new files, for security and correctness. Nothing else in the tree imports the package yet, so no existing behavior or public API changes. The code does no logging, persistence or validation of secret values, which matches the stated "serializer only" scope. I did not check the field names against the pinned Multipass definitions because that repo is outside this checkout. No repo-local criteria loaded, so only the base criteria and the SDK-compatibility criteria were applied.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still calls the package pkg/secretcontracts, but it is pkg/secret (pkg/secret/doc.go:4). There are no secretcontracts references anywhere in the tree. Connector authors who follow this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

[github-actions]

General PR Review: Add simple credential payload builders

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - base ref highb/connector-declared-secret-types is not the default branch main for .claude/skills/ci-review.md.
Review mode: full
View review run

Review Summary

This PR adds a new standalone package, pkg/secret. It has five structs with JSON tags (PasswordV2, APIKeyV2, SSHKey, OAuthClientSecretV2, Certificate) whose Encode() methods call json.Marshal and return a Payload{ContentType, Bytes}. It also adds a generic EncodeJSON/EncodeText pair, content-type constants and table-driven serialization tests. I scanned the full PR diff, which is five new files, for security and correctness. Nothing else in the tree imports the package yet, so no existing behavior or public API changes. The code does no logging, persistence or validation of secret values, which matches the stated "serializer only" scope. I did not check the field names against the pinned Multipass definitions because that repo is outside this checkout. No repo-local criteria loaded, so only the base criteria and the SDK-compatibility criteria were applied.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• Prior — still present (documentation, high confidence): the PR description still calls the package pkg/secretcontracts, but it is pkg/secret (pkg/secret/doc.go:4). There are no secretcontracts references anywhere in the tree. Connector authors who follow this PR or the stacked IGA-4093: Bind native credential inputs and typed outputs #1195 could use the wrong import path.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/secret/doc.go`:
- Around line 4: The package is `secret` (import path `github.com/conductorone/baton-sdk/pkg/secret`), but the PR description still calls it `pkg/secretcontracts`. Update the PR body, and any references in stacked PR #1195, to use the current import path.

---

Reviewed commit: cea69d517c75

[github-actions]

No blocking issues found — see the full review report