# Memory — mgf-secrets

> Project working memory (AG-17). Durable federation memory lives in the mgf
> workspace (`.claude/memory/`); this file is the per-repo pointer + local notes.

## What this repo is

Phase 1 of the Foundation Secrets program: the committed `SECRETS.toml` registry
(declared truth, zero values, fails closed) + a strictly read-only doctor proving
declared == deployed == consumed. Stdlib-only, namespace package `mgf.secrets`,
CLI `mgf-secrets`.

## Load order

1. `README.md` — what the tool does + usage.
2. `SCOPE.md` / `DEPS.md` — the boundary + dependencies.
3. `docs/inprogress/MGF_STANDARDS_CONFORMANCE.md` — the per-MUST ledger.
4. The program proposal + SPEC-P1 in the mgf workspace (`court/proposals/`).

## Notes

- AG-18 is absolute here: no secret value ever enters context, output, or a
  transcript. `list`/`show` are metadata-only; C6 decodes a JWT `exp` in-process
  and emits only the integer.
