The systems Bernstein bridges to, named the way you name them. Use this page to answer "does it talk to the thing I already run" without reading the tracker.
Every row cites its evidence. Shipped names a module and a test you can open. Open names an issue number. Not planned gives the reason in one line. A row that can cite none of the three is deleted, not softened — the same rule the compliance packs run under, where a claim with no evidence behind it is not a weaker claim, it is not a claim.
One column here does not appear on pages like this, and it is the one worth reading: Wired says whether anything in a running system actually reaches the module — an import chain from a CLI command, a route registered on the server app, or a package entry point. A mention in a docstring is not a caller, and neither is an entry in core/__init__.py's redirect map. A module with a green test suite and no caller is a working feature to every reader of the source and to nobody else (see #5093). Where the two differ, this page says so.
No module and no issue. vault_injector.py's three injectors are the shape a fourth would take.
The directory, SSO, policy-engine and secret-injection modules are not wired.vault_injector, sso_oidc, external_policy_hook, directory_bridge and the SCIM adapter all ship with tests and none of them is reached from a running system. The only reference to vault_injector anywhere in src/ is an alias entry in core/__init__.py's redirect map; sso_oidc and external_policy_hook are named in neighbouring docstrings (rbac.py, authzen.py) and imported nowhere; directory_bridge has one TYPE_CHECKING import from directory_registry.py, which is itself unreachable; and adapters/directory/__init__.py imports the SCIM adapter while nothing imports that package.
This is the exact shape #5100 describes — the redirect map and a prose mention both make a module read as reachable to any tool that asks "does this name appear anywhere" — and most of these are in the caller-less set on #5505.
core/security/external_policy_hook.py (OPAHook) · tests/unit/test_external_policy_hook.py — fires before the permission check; the response overrides the default
no — named in authzen.py prose only, imported nowhere
#4912 — engines are bridged but the decision path is incomplete
—
Cedar
core/security/external_policy_hook.py · same suite
A row moves to Shipped when a module and a test exist, and names both.
Wired is a separate question from shipped. It is answered by an import edge from something reachable — a CLI command, a registered route, a package entry — not by the name appearing somewhere. A docstring that names a module is prose; core/__init__.py's redirect map is an alias table. Neither is a caller, and both will fool a grep.
A capability that is neither shipped nor tracked by an issue does not get a row. Aspirational entries are the failure mode this page invites.
Comparisons with other projects belong nowhere on this page.