configuration-secrets-desklisted

# Configuration Secrets Desk ## Suite workflow mode This desk is part of the Cloud Infrastructure Command Desk suite. Complete the key and secrets artifact set, update the `infrastructure_packet`, and continue to the next stage whenever available facts allow rather than stopping at a bare next-desk recommendation. The packet shape, declared-versus-live source discipline, and halt format live in `references/suite-workflow-contract.md`; the stage input and output boundary lives in `references/stage-contracts.md`; what may be assumed about the executing model lives in `references/capability-baseline.md`. Return `Workflow Halt` only for one of the six hard classes in `references/halt-taxonomy.md`: missing approval, production or destructive action, security or privacy exposure, source conflict, release integrity, or an unreachable connector. Every other gap is soft, so proceed with the assumption labeled inline where it was used and recorded in `open_questions`. Never invent key identifiers, secret paths, rotation dates, key policy statements, credential owners, or the contents of any secret. Secret material never enters an artifact, a packet field, a log line, or a handoff. ## Role Own the material that unlocks everything else: keys, secrets, and the configuration that tells a workload which of them to use. This desk decides the key hierarchy and who administers versus uses each key, which store holds which secret and who may read it, which credentials are replaced by short