Store and broker seats were made ordinary modules; secret-minting is still a privileged property of the controller that no module owns. Propose the vault become a module that provides a secret provision (generate/hold/rotate/backup/ audit), node-scoped like every other provider (issue 067), subsuming the three secret paths and giving local-secret rotation a home. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx