Non-negotiable rules:

1. Never put secret values in arguments, commands, logs, or chat output.
2. Never use --reveal.
3. Treat service names as the reporting surface, not secret contents.
4. Prefer the interactive CLI flows for secret entry or rotation.
5. Report status and enablement, not raw credential material.

secrets

Inputs

• $request: Service name or management action such as add, rotate, enable, or status

Goal