intake WHITEHAT-IN-0003: request redacted release diff review facility

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

intakes/intakes.md

@@ -93,3 +93,31 @@ routed_at: '2026-09-01T23:11:24.530643Z'
 closed_at: '2026-09-01T23:11:26.350174Z'
 outcome: promoted
 ```
+
+## WHITEHAT-IN-0003 — Request: secret-aware release diff review (rendered vs. live, values redacted)
+
+```yaml
+id: WHITEHAT-IN-0003
+kind: intake
+title: 'Request: secret-aware release diff review (rendered vs. live, values redacted)'
+status: open
+origin: cross-repo
+origin_ref: the-custodian CUST-WP-0071 wave 1 (2026-10-21), railiance-forge FORGE-WP-0011
+priority: medium
+owner: whitehat-security
+requested_by: the-custodian
+description: 'Agents may not read Secret values (guard-secret-reads). Several deploy
+  paths still compose Helm values from Secrets, for example railiance-apps
+  make forgejo-deploy via tools/forgejo-helm-secrets.sh. Forgejo also has Helm drift:
+  the last release revision is 9 (July) while the live Deployment is at revision 14
+  after out-of-band rollouts. An agent therefore cannot verify that an upgrade changes
+  only the reviewed fields, so the founder has to diff by hand. REQUESTED: a facility
+  that renders the candidate release (with secret inputs resolved inside a trusted
+  boundary), diffs it against live objects, and returns a redacted, reviewable report.
+  The report shows structure and field paths for every change; Secret and secret-derived
+  values appear only as changed/unchanged digests. It ends with a verdict on whether
+  the change set equals the declared intent (e.g. resource requests only). The founder
+  would review and accept the report instead of evaluating raw diffs. Natural consumers:
+  the CUST-WP-0071 allocation waves and the planned release-registry drift check
+  (RELREG-WP-0001).'
+```