EXTENSIONS

GPG-encrypted password store using the pass CLI (passwordstore.org). Can return just the first line of a multiline entry (the password, by pass convention) or a named metadata field such as login. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key and field names, and backend only — never secret values or error messages.

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

TPM 2.0-backed non-exportable OpenPGP key via tpm2-pkcs11 + gnupg-pkcs11-scd; presents a ready GNUPGHOME for a pass vault (generate/unlock/status/revoke).