Secrets infrastructureVault data
Vault items
Create, list, inspect, update, resolve, and remove encrypted records through the operator surface.
Vault items — contract and behavior
- Item field values are encrypted; only the metadata required to locate and manage an item remains outside the encrypted payload.
- List and inspect commands avoid printing secret values unless the operator explicitly uses a resolving command.
- Updates re-encrypt the complete affected payload to the current recipient group.
- Deletion and replacement append auditable state transitions rather than silently mutating historical evidence.