spiffe — workload identity (SPIFFE / SPIRE)
SPIFFE workload identity — X.509-SVID, JWT-SVID, trust bundles, and the SPIRE workload API client.
secrets — Vault / cloud secret stores
Unified SecretStore protocol with AWS Secrets Manager, GCP Secret Manager, and HashiCorp Vault backends.
labels — runtime classification tags
Label values, explicit flow comparisons, and the Labeled wrapper API.
regions — Tofte-Talpin region calculus
User-facing surface for Verum's region-calculus analysis — model and reason about region-typed values, lifetime environments, and escape checks.
capabilities — supported boundaries
Value-level capability restrictions, unsupported authorization annotations, and the distinction from runtime classification labels.