ADR-0112: OpenBao or client vault (MPL-2.0 exception)

• Status: accepted
• Date: 2026-10-30
• French version: ../ADR-0112-openbao.md

Context

The kit prefers Infisical OSS or the client vault.

Updated by ADR-0169 on 2026-11-01: Infisical OSS is no longer offered; secrets stay in OpenBao or the client vault.

Decision

OpenBao (MPL-2.0) stays deployed, recorded as an exception in catalog/licence-exceptions.yaml, until the secret provider interface is validated against the client vault.

Consequences

File level MPL-2.0 obligation if the image is modified.

Evidence

• catalog/licence-exceptions.yaml
• deploy/openbao
• services/control-plane/src/eai/integrations/openbao.py
• catalog/components/client-vault.yaml