Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

internal/inventory/secrets.go

@@ -554,6 +554,19 @@ func (i *Inventory) declared(ctx context.Context, module string) (catalogue.Mani
 	return m, nil
 }
 
+// DeclaresOwnSecret refuses, in words, a module the mesh does not know or an own secret its definition does
+// not declare: asked before anybody is asked for a value, so nobody types one the mesh would refuse.
+func (i *Inventory) DeclaresOwnSecret(ctx context.Context, module, name string) error {
+	m, err := i.declared(ctx, module)
+	if err != nil {
+		return err
+	}
+	if _, ok := m.OwnSecrets[name]; !ok {
+		return fmt.Errorf("%s does not declare %q as an own secret; %s", module, name, declaresOwn(m))
+	}
+	return nil
+}
+
 func declaresOwn(m catalogue.Manifest) string {
 	if len(m.OwnSecrets) == 0 {
 		return "it declares no own secrets"