Metadata and sensitivity | Rivet Documentation

Metadata is separate from resource-specific fields. Use at most one unlabelled meta block:

file "config" {
  path    = "/etc/app-config"
  content = "managed\n"
  meta {
    description = "Application configuration"
    tags        = ["application", "configuration"]
    sensitive   = true
    noop        = false
    timeout     = "30s"
  }
}

Field	Default	Behavior
`depends_on`	Empty	List of prerequisite handles.
`before`	Empty	List of handles ordered after this resource.
`notify`	Empty	Request target refresh after this resource verifies a change.
`subscribe`	Empty	Request this resource’s refresh after listed sources change.
`description`	Omitted	Optional string describing intent.
`tags`	Empty	List of strings, normalized to a set; no CLI tag-filter option exists.
`noop`	`false`	Inspect/predict this resource without mutating it.
`sensitive`	`false`	Mark this resource and assets as sensitive.
`timeout`	Resource default	Positive integer duration in `ms`, `s`, `m`, or `h`, at most 24 hours.

Metadata booleans require booleans, not null or string equivalents. A resource’s deadline includes inspection, guards, mutation, subprocesses, and verification. Refresh gets a separate deadline. Native operations check deadlines between steps; an uninterruptible kernel call cannot be forcibly cancelled.

Default budgets are 60 seconds for files/users/groups/group memberships/SSH keys, 300 seconds for packages/exec/mounts, and 120 seconds for services/timers.

Module metadata is a narrower contract: depends_on, before, noop, tags, literal description, and notify. Module noop and tags inherit; subscribe, timeout, and sensitive are rejected on modules.

Sensitivity

Sensitivity propagates through variables, locals, interpolation, references, outputs, and assets. Deduplicated assets keep the strongest annotation. Password hashes are intrinsically sensitive even when meta.sensitive = false.

Sensitive command output is omitted. Diagnostics report safe categories and source locations, without source excerpts or evaluated values. Reports/journals expose changed property names and digests rather than file content or password hashes. Successful nonsensitive exec output is an explicit exception: it can appear in JSON and stored final reports.

Sensitivity is not encryption. Bundles can contain plaintext secrets and root output values. They are published with mode 0600; keep configuration, facts, bundles, and copies appropriately private.

Every resource handle exposes meta.sensitive; it reflects intrinsic sensitivity as well as declared policy. A false annotation cannot declassify a sensitive value. sensitive, nonsensitive, and issensitive provide explicit value policies; nonsensitive removes value sensitivity recursively while retaining dependencies. Password-hash resource fields reassert their intrinsic sensitivity; RSA decryption initially marks its result sensitive. SOPS layers automatically mark supplied variables sensitive, even when later replaced by plaintext inputs.