SOPS Secret Access

Use the repo's encrypted source of truth when a task depends on secrets or private tool configuration. Do not infer from public fallback files if a matching *.sops.* file exists.

New SOPS payloads are JSON (*.sops.json). See ADR-0011. Decrypt existing non-JSON files if that is what the repo already has; do not add new ones.

When to Use

• A project has components.sops.json, secrets/*.sops.json, or another SOPS-encrypted config.
• A public config looks incomplete and a private registry, API, MCP server, deployment credential, or provider profile may be hidden behind SOPS.
• The task mentions shadcnblocks, private shadcn registries, registry auth, SOPS, secrets, env loading, or encrypted project config.
• A tool only shows public/default config but the repo has a likely encrypted companion file.

Core Rules