:schema https://fnox.jdx.dev/schema.json

The secret mise run gates:record needs, DECLARED and nothing else: no value and no provider is written here, so there is nothing to leak and nothing to choose for you. fnox is optional. Without it the command reads the name from its environment. To use it, put your own provider in fnox.local.toml (gitignored) or in ~/.config/fnox/config.toml. The tests need no key: they talk to a fake Jev.

tools/with-secrets.sh runs a command under fnox exec when fnox is set up, and plainly otherwise.

A name nobody has provided is left unset (record-gates then says what is missing), not an error here.

11if_missing = "ignore"