Matt Cockayne authored Aug 17, 2026 and Matt Cockayne committed Aug 17, 2026

vaultapi.NewClient reads VAULT_TOKEN once and holds it for the life of the
client, so a long-lived process reloading configuration fails every Load once the
TTL expires. Documented on config-vault's Default in v0.4.0; this is the same
warning on the docs site, where a reader choosing a rung will actually meet it.

Verified against vault/api v1.23.0, client.go:665.

Output of the frozen-credential audit across all thirteen remote adapters.

The deciding property is whether the object an adapter holds is a MEANS of
obtaining a credential or a credential itself. AWS, Azure and GCP hold a means
and refresh underneath the caller; etcd holds a username and password and
re-authenticates; keychain holds nothing and re-resolves per call. Vault and
Consul hold an already-minted token and never renew it.

connection-ownership.md gains the principle and the two tables; consul.md gains
the same warning vault.md already carries.

Verified against consul/api/v2 v2.0.0, vault/api v1.23.0, aws-sdk-go-v2/config
v1.32.37, azcore v1.23.0, cloud.google.com/go/auth v0.23.1 and etcd client/v3
v3.7.1.

Matt Cockayne authored Aug 18, 2026 and Matt Cockayne committed Aug 18, 2026

connection-ownership.md gains a section naming all five estate modules, what
each yields, and why there is one per provider rather than one combined — the
footprint segregation argument was only implicit before.

The three GCP how-tos mentioned go/gcpclient in a code comment with no link and
no explanation of why it yields options rather than a client. They now say so and
link it.

Matt Cockayne authored Aug 18, 2026 and Matt Cockayne committed Aug 18, 2026

The five sites are deployed and their domains verified, so the links no longer
need to fall back to the repository. A repo link answers 'where does this live';
a docs link answers 'how do I use it', which is what a reader following one of
these actually wants.