{"title":"The secret sources","kindGlyph":"≡","kind":null,"status":"ratified","opener":"A secret is a masked reference, never a literal: it resolves from vault, env or file at run time and stays masked in every log and every trace the run leaves behind.","rows":[{"label":"layer","value":"boundary"},{"label":"member-of ←","links":[{"label":"env","href":"/language/secrets/env"},{"label":"file","href":"/language/secrets/file"},{"label":"vault","href":"/language/secrets/vault"}]},{"label":"member-of →","links":[{"label":"The boundary","href":"/how/boundary"}]}],"door":{"label":"open the page","href":"/how/boundary"}}

the registers

The secret sources.

A secret is a masked reference, never a literal: it resolves from vault, env or file at run time and stays masked in every log and every trace the run leaves behind. The teaching lives on /how/boundary; this root lists the rooms.

3membersone room each
ratifiedthe clockre-proven at every push
/how/boundarythe teaching hubwhere the register is taught
language/secretsthe familythis root lists its rooms

the rooms

3 doors

env
read from the environment at run time
file
read from a path the boundary allows
vault
the OS keychain backend · the default posture

The whole lens lives in the map. Read the spec →