Expand description
Supervised client for external secret resolver/sink executables.
Secrets travel only over a private local channel. Values are never put in argv, environment, plans, or logs. Sessions are action-scoped: every resolve /store/delete carries the approved action identity.