# CLAUDE.md — mgf-secrets

Project-specific notes for AI agents. The federation-wide briefing is
`mgf-fed agents`; this file carries what is specific to this repo.

## What this repo is

Phase 1 of the Foundation Secrets program: the committed `SECRETS.toml` registry
(declared truth, zero values, fails closed) + a strictly **read-only** doctor
proving declared == deployed == consumed. Stdlib-only; namespace package
`mgf.secrets`; CLI `mgf-secrets`.

## Non-negotiables

- **AG-18 absolute:** no secret value ever enters context/output/transcripts. Use
  file paths + in-process reads. `list`/`show` are metadata-only.
- **Read-only against the world (P1):** the only writes are files in git working
  trees + this repo. No mutation of any secret/host/Woodpecker/forge state.
- **No ungoverned growth:** a new kind/surface needs a doctor check + probe
  handler + replay fixture (kind-extension meta-test enforces).
- Commit trailers: both `Signed-off-by:` and `Co-Authored-By:` (AG-03).
