arcasecrets broker for agents — sealed, not spilled

arca:// references in code, env vars at runtime, an audit trail for every materialization

References, not values

arca://name URIs in code and config — nothing sensitive lives in the repo at all

architecture

arca run injects secrets as env vars — agents run commands without ever seeing keys; --json + manifest/schema everywhere

CLI reference

the arca-vault port — local age-encrypted file first, a self-hosted Cloudflare Worker + D1 backend too; ciphertext-only everywhere

env routing

every resolve, denial, and failure records actor, ref, env, timestamp — an ndjson wire on stderr; Secret redacts by construction

audit contract