Safety model

NXD separates planning from mutation:

• plan observes state and writes a reviewable proposal;
• apply executes exactly one persisted plan;
• verify checks live postconditions without producing mutation actions.

Secrets are represented by bindings in configuration and resolved only at runtime. Secret values must not appear in Nix, canonical JSON, plans, logs, events, argv, URLs, or committed documentation.

Plan cleanup is explicit and recoverable. nxd clean is a dry run unless --apply is supplied, and even then it archives only expired plans without approval, journal, or pin evidence. It never deletes reviewed evidence. Use --pin <plan> before long-lived review, --unpin <plan> when that protection is no longer needed, and --recover <archived-plan> to restore an archived plan. Recovery does not bypass plan expiry, compatibility, or approval checks.

Interactive durable enrollment workflows (deploy, switch --reenroll, and install/convert intents) ask once for the exact enrollment plan and a displayed, bounded same-session continuation across selected targets. The continuation is freshly planned, persisted, digested, and validated against the authorized scope before approval evidence is written. Any changed source, target, action, provider, secret, dependency, or risk stops for explicit review. Non-interactive and separate plan/apply workflows continue to require approval evidence for each plan digest.

Default plan output and interactive approval prompts render a target-grouped summary of pending work, listing destructive and identity-critical actions first and naming exact resources touched. --verbose renders the full action graph with identifiers and dependency edges.