Private files
Overlays and the secret detector.
Overlays (files, readers, key managers, key epochs) are managed in Code → Overlays.
Secret detector
Layr refuses a save or push that copies a secret value into shared files.
| Pattern | Action |
|---|---|
| .env* | refuse in shared files |
| *.key | refuse in shared files |
| config/*.pem | refuse in shared files |
Declassified values
Values marked as not secret. Only an HMAC fingerprint is stored, never the value.
| Fingerprint | Path | Approved by | State | Reason |
|---|---|---|---|---|
| hmac:91c0…7a2e | tests/fixtures/fake.key | alice | 9a0c13d7 | Test fixture, not a real key |
| hmac:0f3d…c118 | docs/example.env | bob | b17a2c90 | Example value from the docs |
$ approve --declassifylayr approve --declassify tests/fixtures/fake.key 9a0c13d7
Recent refusals
| When | Who | Operation | Path | Result |
|---|---|---|---|---|
| 6 min | agent-7 | save | src/coupons/test.rs:14 | ✕ refused |
| yesterday | bob | push cloud | web/.env.local | ✕ refused |