Secrets registry

Credentials for the platforms your capabilities call. Add or rotate a token here — no redeploy — then reference it from a wired capability as secret://<name>. Values are encrypted at rest and write-only: they are never shown again.