Asked
A static read of the public repository against two claims: a dumb vault that houses all secrets, and that neither the IDE agent nor the vault agent sees what the daemon sends upstream. It also separates this repository from the DeFi projects that use the NoEnv name.
What it signed
AES-256-GCM at rest inside vaultd. The warden reviews metadata only. It can raise risk or block a standing approval, and it cannot override a deterministic denial or read a key. Standing approval is re-checked in the daemon: read-only scope and low marshal risk, or HTTP 403. The authenticated upstream call is built inside vaultd. The IDE agent receives the result without the raw key. The marshal stops before execution and does not receive that result. The product warden is TypeSafe Jev.
What it would not sign
Windows Hello as custody of the encryption key. The review says Hello checks the Electron lock screen only. It would not sign "they only got the result" as complete: the marshal never receives the result, and the IDE agent's isolation still depends on the upstream not echoing the secret. It would not treat 127.0.0.1:7077 as an authenticated admin boundary for another process under the same user. It called the Windows installer unreleased candidate behavior, and the two newest commits it inspected were failing CI.
