Walkthrough

Adds a subsection to the typed-credentials ADR describing credential resolution across three lookup paths (direct leaf credentials, indirect plugin-backed DAG resolution with ingestion-time cycle rejection, and repository fallback only when the DAG has no match) and appends a 2026-05-05 changelog entry summarizing these mechanics.

Changes

Typed credentials ADR

Sequence Diagrams

sequenceDiagram
  participant Ingestor
  participant Graph
  participant Plugin
  participant Repository
  Ingestor->>Graph: construct DAG (identities + credential nodes)
  Graph->>Plugin: depth-first resolve plugin-backed identity
  Plugin->>Graph: return child identities until leaf
  Graph->>Graph: detect and reject cycles at ingestion
  Graph->>Repository: if DAG has no match -> run repositories concurrently (first success wins)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• open-component-model/open-component-model#2149: Related to typed credentials and resolver behavior; complements documented resolution order and fallback semantics.

Suggested labels

size/m

Suggested reviewers

• fabianburth
• morri-son

Poem

A rabbit hops through credential trees so neat,
Leaves hold direct secrets, plugins chase the beat,
DAGs are built at ingest — no cycles may meet,
Repos wait if the graph yields no treat,
Docs bloom bright — the spec is now complete! 🐰✨

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn