The only screenshots worth committing
Golden references are test inputs and belong in version control; run captures are regenerable evidence and do not. Conflating them loses the reference.
conventions
4 posts
Where a secret lives should never be a decision
Six consumers each deciding where a keystore lives agree until one changes. One registry keyed by stack and category, one resolver, no direct reads.
Two prefixes decide who owns a credential
Whether a credential is organisation-wide or per-app has to be visible in its name, because the name is what every manifest and resolver decides from.
Version state belongs in exactly one file
A version repeated across build files, manifests and tags is one fact with several caches. Decide which copies are derived and forbid everything else.