Scaffold the trove vault at TROVE_PATH: create directories, generate or register the age keypair, write trove.toml, .gitignore, CONVENTIONS.md and a pre-commit safety hook. Idempotent. Returns paths created, the recipient, and a key-backup warning.

Save a plaintext snippet as Markdown with frontmatter under snippets///.md, then rebuild the index. Provide body_markdown already segmented (prose outside fences, code in fenced blocks).

Save an encrypted secret under secrets//.age plus a cleartext metadata sidecar (title, tags, dates — never values). Encrypts in memory with age; plaintext never touches disk. Requires recipients in trove.toml.

Decrypt a secret and return its fields. Requires the private key at the configured key path. Values are returned to you, never written to disk.

Update an existing secret without re-supplying it whole: set/remove fields, change notes or tags, then re-encrypt. Decryption needs the private key; re-encryption needs recipients. Preserves the created date.

Search the vault. Full-text over snippets; metadata-only over secrets (title/tags/category, never values). Filter by tags and kind.

List all entries (snippets and secrets) with their tags and paths.

Regenerate INDEX.md from current frontmatter and secret metadata.

Remove an entry by name and rebuild the index. For secrets, both the encrypted payload and its metadata sidecar are deleted.

Read-only health and safety audit: missing key, no recipients, cleartext under secrets/, orphan payload/metadata, broken frontmatter, a private key in the tree, missing pre-commit hook. Returns findings with severity and fix.