Where secrets go

A store gives a secret a place to rest, but the value itself still has to arrive: enter under control, reach the runtime, build, deployment, and local-development surfaces, and leave evidence that live state still matches what was declared. This series names that route as one delivery transaction, reviewable before it scatters across console clicks, scripts, and build credentials nobody wants to call the authority.

1. 1A secret has to arrive

   One logical credential slot becomes a delivery problem when production, local development, build automation, and deployment code all need it in different forms, and the route has to be recorded as state

2. 2Delivery is a transaction

   A delivery transaction keeps authority, outputs, wiring, and proof limits with the same secret write, so rotation compares one applied receipt instead of scattered evidence

3. 3The bundle is the competitor

   A bundle of encrypted files, store writes, infrastructure code, and scripts can deliver a secret; the design only shows itself when the graph changes, when rotation has to prove every output moved and revocation has to re-key rather than edit a list