## Stack

- **Language:** Python 3.11+ CLI (`src/secrets_engine/`), `uv`-managed, hatchling build
- **Backend:** OpenBao, reached only via the `bao` CLI adapter (`openbao.py`)
- **Key deps:** PyYAML (runtime), pytest (dev); State Hub for decisions/evidence
- **Entry point:** `secrets-engine` (console script → `secrets_engine.cli:main`)

## Dev Commands

```bash
# Install (editable, with dev extras)
uv venv && uv pip install -e ".[dev]"
source .venv/bin/activate

# Run the CLI
secrets-engine --version
secrets-engine catalog list

# Test (unit + live OpenBao integration; integration auto-skips without `bao`)
SECRETS_ENGINE_HUB_URL="" python -m pytest -q

# Full pilot chain live against a throwaway OpenBao dev server
SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh

# Orient (offline-safe)
cat .custodian-brief.md
ls workplans/

# After workplan edits — from ~/state-hub
make fix-consistency REPO=secrets-engine

# Sanity-check edits
git diff --check
```