RFC-0006: Blueprints
Version: 0.1.0 | Status: draft | Phase: spec Owners: @Will Eaton
1. Summary
[RFC-0006:C-SCOPE] Scope (Informative)
A blueprint is a registered playbook its owner offers as a starting point. A user picks one from the catalog and gets a draft of their own, seeded from the blueprint's pack, with the owning team's secrets already bound when they are on that team, and a placeholder for each secret they bring themselves. The draft is then theirs to edit, launch, and publish like any other.
This RFC adds to the ownership, sharing, and policy rules of RFC-0003; it does not change who may read, launch, or bind anything outside a blueprint's use.
2. Specification
[RFC-0006:C-BLUEPRINT] Blueprints (Normative)
A blueprint MUST be a registered playbook its owner has marked as a blueprint; a draft, a pack import, or an unregistered pack MUST NOT be one. Marking and unmarking MUST be the update action on the playbook. Marking MUST be refused unless the caller holds bind on every secret whose binding on the playbook would carry under RFC-0006:C-CARRY, and the refusal MUST name those secrets the caller may read and count the rest. A blueprint's revision MUST be the playbook's registered revision. Unmarking MUST NOT change a draft already created from the blueprint or a binding already carried.
Marking is checked against bind because it makes bindings already on the playbook carry. A binding added after marking is made by someone who holds bind and is told it carries.
[RFC-0006:C-CATALOG] Catalog (Normative)
The controller MUST serve a catalog listing the blueprints the caller may read and no others, under RFC-0003:C-READ-SCOPING. Each entry MUST give the blueprint's id, description, owner, current revision, and whether it is public, and for each secret its pack declares, whether that secret would carry to the caller or become a placeholder under RFC-0006:C-PLACEHOLDERS.
A team's blueprints appear to its members, a viewer share under RFC-0003:C-SHARING lists one for another principal, and a public blueprint under RFC-0006:C-PUBLIC appears to everyone.
[RFC-0006:C-PUBLIC] Public blueprints (Normative)
Making a blueprint public or private MUST be the share action on the playbook, and MUST be audited as a share grant or revocation under RFC-0003:C-AUDIT. In addition to the grants of RFC-0003:C-POLICY, the default policy set MUST grant every authenticated user principal read on a public blueprint, and publicity MUST NOT confer any other action or the read of the blueprint's shares. Only a blueprint MAY be public: unmarking a blueprint MUST make it private. Making a blueprint private MUST NOT change a draft already created from it or a binding already carried.
Publicity widens who sees a blueprint, not what carries: RFC-0006:C-CARRY still requires the user to be in the owning team, so everyone else gets placeholders. The platform administrator team's public blueprints are the catalog every user starts with.
[RFC-0006:C-USE] Using a blueprint (Normative)
Using a blueprint MUST create a new draft, and MUST require read on the blueprint and create of a draft for the chosen owner under RFC-0003:C-OWNERSHIP. The request MUST name the new draft's id and MAY name the blueprint revision it expects; a request whose expected revision is not the current one MUST be refused. The draft MUST be seeded from the blueprint's current revision and MUST record the blueprint id and revision as its origin. The response MUST list each binding carried and each placeholder created, with the placeholder's reason. A refused use MUST leave no draft and no binding.
[RFC-0006:C-CARRY] Carried bindings (Normative)
A binding on a blueprint carries to the new draft when all of these hold: the blueprint's owner is a team; the bound secret's owner is that team; the request's subject set includes that team; the binding is not restricted to a reviewed pack revision; and every check a direct bind of the secret by that subject makes, other than bind itself, passes. A carried binding MUST bind the same secret under the same declared name, projection kind, and projection, with the new draft as its scope. Creating it MUST be decided as bind on the secret for the request's subject, with the source blueprint in the request. In addition to the grants of RFC-0003:C-POLICY, the default policy set MUST permit that decision whenever the conditions above hold. No other way of creating a draft carries a binding under this clause.
Each carried binding MUST record its origin, the source blueprint and source binding; MUST be audited as a bind whose actor is the request's actor; and MUST be listable by origin by any subject that may read the secret. A carried binding is independent of its source once created: unbinding or rebinding either MUST NOT change the other. A response that creates a binding on a blueprint MUST state whether that binding carries.
Binding a team secret to the team's blueprint lets every member use it from a draft they can edit. Members already launch with it from the team's own playbooks; carrying extends that to code they change, so a binding restricted to reviewed code never carries and each copy names its source.
[RFC-0006:C-PLACEHOLDERS] Placeholders (Normative)
Each secret the blueprint revision's pack declares that does not carry MUST become a placeholder on the new draft. A placeholder MUST give the declared name, the projection kind and projection of the blueprint's binding when one exists, and the first reason that applies of: no binding on the blueprint; a binding restricted to a reviewed revision; a secret owned by a user; a secret not owned by the blueprint's owner; a team the request's subject set does not include; a bind the active policy set denies; a check of a direct bind that did not pass. A placeholder MUST NOT reveal the bound secret's name, owner, or storage location to a subject that may not read that secret.
A placeholder MUST be filled by an ordinary bind on the draft, which requires bind on the secret the user chooses, and that bind SHOULD default to the placeholder's projection. Reading the draft MUST list its unfilled placeholders. A placeholder MUST be dropped once the draft binds its declared name or its pack stops declaring it. A launch of a draft with an unfilled placeholder MUST be refused naming the placeholder.
A personal secret never leaves its owner: the blueprint passes on what to bind, not what was bound.
Changelog
v0.1.0 (2026-11-02)
Initial draft