[ChristianPavilonis]

Summary

• Specify context-derived secret bindings, keeping raw native credential values and existing config reference strings while deriving lookup keys from purpose, identity, and approved destination.
• Include the independent design comparison's seven required amendments covering provisioning ABI stability, unresolved/resolved normalization, reference validation, CLI/native parity, private exporter construction, policy retirement, and send/diagnostic behavior.
• Define the twelve secret contexts, four-adapter provisioning model, migration and rollback requirements, and executable release gates.

Changes

File	Change
docs/superpowers/specs/2026-10-16-issue-1037-context-derived-secret-bindings-design.md	Add the selected standalone design and its required implementation/proof contract.

Related issue

Refs #1037. This is a documentation-only design PR, not the security implementation. It deliberately does not close the issue. Runtime changes, the companion EdgeZero lookup-plan release/pin, migration tooling, and native security tests remain future work.

Test plan

• Docs lint: npm run lint --prefix docs
• Full docs formatting: npm run format --prefix docs -- --log-level debug
• Documentation site build: npm run build --prefix docs
• Focused Prettier check and git diff --cached --check
• Re-ran the isolated fictional encoding model and confirmed the documented vector, framing samples, and generated-name lengths. This is not the shipping Rust implementation or runtime security proof.
• Checked the standalone spec for vault/local-only references, all twelve scope rows, and fictional/reference URL hosts.
• Repository URL-host linter: the installed ts lacks dev lint; attempts to build/run the repository CLI, including locked/offline runs, timed out during compilation before the linter executed. Static URL inspection found only github.com and example.com subdomains. Keeping this PR in draft pending that check.

No runtime behavior changed. Rust adapter suites, browser rendering, and native-provider credential/TLS/redirect tests were not run for this documentation change. The spec explicitly requires runtime proof before release. The docs build passed with warnings about existing VCL syntax highlighting and bundle size.

Checklist

• Follows repository documentation and commit conventions
• Documentation-only; no production code, config, dependency, or provisioning changes
• No secret values or real deployment data committed
• Keeps issue Scope secret references to prevent config-store writers exfiltrating unrelated secrets #1037 open until implementation and security verification