Console
Vault
Secret contracts, who can read each, rotation due.
Answers: secret contracts, who can read each, rotation due
Governing rule
Secrets are write-only — the panel can set and rotate; it can never reveal.
What this panel shows
Fingerprints
Salted hash per environment — rotation and drift without exposure.
Resolution chain
Which source won: env, files, vault driver, or fallback.
Who can read
Derived from effects that declare `fx.vault`.
Rotation blast radius
In-flight durable runs that wake with a new key.
Catalog
Dev
full
Prod
set/rotate only, never reveal