Bootstrap secrets before configuration loading

docs/operations.md

@@ -554,7 +554,17 @@ API keys are credentials, not ordinary workspace data. Store them outside the
 shared workspace or in a separately restricted credential location; ordinary
 workspace group access must never be treated as authorization to read keys.
 Provision a credential directory as `0700` and credential files as `0600`;
-Narratio rejects group- or other-readable configured credential paths.
+these permission modes are an operator requirement and are not enforced by
+ConfigKit.
+
+Every pipeline-loading command bootstraps credentials once, before the first
+configuration load and before any adapter is constructed. `--secrets-dir`
+selects an explicit directory (relative paths use caller CWD). Otherwise a
+present `secrets/` beside the resolved root pipeline is used, while an absent
+conventional directory is skipped. Explicit missing/empty selections and
+invalid existing directories fail the command. ConfigKit follows a symlink used
+as the selected directory, but immediate entries must be regular non-symlink
+files. Existing environment variables—including empty values—always win.
 
 External adapter results are individually bounded before Narratio validates or
 materializes them. These per-file limits do not reserve disk space: prevent hard
@@ -617,4 +627,5 @@ normal migration path.
 - Publish requires prerequisite stages through `render` and `analyze` to be succeeded.
 - Markdown publish defaults require render outputs (`transcripts/final.md` and `transcripts/final.trimmed.md`).
 - Restore requires configured object storage and committed remote current state.
-- Storage-backed commands load filesystem secrets before object-store initialization.
+- Pipeline-loading commands bootstrap filesystem secrets once before configuration
+  resolution and object-store initialization.