CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend:
pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line.
Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes,
install, fresh-session proof, import names+lengths, history sweep names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/12-agent-tooling.md

@@ -61,3 +61,12 @@ secret rule or a review step, or remove a rule — that is the operator's. The f
   An instruction that carries state goes stale silently; a pointer to where state is read does not.
 - **A procedure is a skill, not a paragraph in `CLAUDE.md`** — a `CLAUDE.md` is paid for on every
   session; a skill only when its trigger matches (doc-authoring skill §2, „The two costs").
+
+## 5. Secrets — how CC obtains one
+
+**Pointer, not a copy:** the private repo `admin/cc-secrets` (cloned at `/mnt/5_hdd/felhom.eu/git/cc-secrets`), its
+`ARCHITECTURE.md`. In one line: an encrypted store (SOPS + age, operator ruling 2026-10-17 11:28), a broker `sec`
+that uses a value by NAME and never prints it, and Claude Code hooks in `~/.claude/settings.json` — so every CC
+session on DooPlex — that refuse the known leak shapes, mask stored values in tool output, and a nightly sweep of old
+session records that mails NAMES only. Built 2026-10-17 (R-1118); evidence `audits/cc-creds-build-2026-10-17/`.
+`runbooks/secrets.md` stays the home of the CLUSTER Secrets.