- Add vault_get wire message to fetch encrypted entries for client-side decryption - Deploy handler resolves $vault: refs: fetches encrypted entries from broker, decrypts with mesh keypair locally, sends resolved env over TLS - File-type vault entries encoded as __vault_file__:path:base64 for runner-side extraction Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>