a furnace for secrets
ATHANOR
Secrets stay out of source and direct tool responses while trusted commands use them inside the process.
How Athanor works
Seal
The secret is encrypted with an age key via sops. The value never touches disk in the clear — not on read, not on write.
Bind
The athanor.yaml manifest decides which secret may be retrieved directly (expose) and which may only be passed to a trusted command.
Transmit
The agent calls run_with_secrets — the secret lands in the process environment. If the command prints it, that output returns to the agent.
grimoire