transcryptlisted

# Transcrypt (shared-key file encryption) Transcrypt stores designated files **encrypted in git** but keeps them **plaintext in the working tree** via git clean/smudge filters. One shared passphrase lives in Doppler (`tools/prd` → `TRANSCRYPT_KEY`), so the same key works across every repo and machine. Files are marked by the `*.secret.*` naming convention in `.gitattributes` (e.g. `notes.secret.md`, `config.secret.json`). ## Context - transcrypt installed: !`command -v transcrypt >/dev/null 2>&1 && echo INSTALLED || echo MISSING` - this repo's transcrypt config: !`git config --get-regexp '^transcrypt\.' 2>/dev/null || echo NOT-CONFIGURED` - encrypt attribute in .gitattributes: !`test -f .gitattributes && grep -i crypt .gitattributes || echo NONE` - working tree: !`git status --short 2>/dev/null || echo "(not a git repo)"` - openssl shim wired: !`git config --get transcrypt.openssl-path 2>/dev/null || echo "none — expect the 'deprecated key derivation' warning on git commands; see that section"` ## The shared key — never generate a new one Every init/unlock uses the Doppler-stored passphrase and `aes-256-cbc` (the standard cipher for these repos). This one sequence is referenced throughout; the key is never printed. Run it from the repo root, and keep every line; the bracket around the middle one is explained below: ``` git config core.hooksPath "$(git rev-parse --path-format=absolute --git-common-dir)/hooks" transcrypt -c aes-256-cbc -p "$(doppler secrets get TRANSCRYPT_