Improve profile inheritance and SOPS write clarity

[domenkozar]

What changed

• add per-secret inherit = false for declarations in [profiles.default]
• preserve field inheritance when another profile explicitly redeclares a local-only secret
• show the resolved provider, profile, and native destination before secretspec set writes
• show exact SOPS file paths and selectors, and document SOPS storage layouts and secret references
• clarify how profiles, scopes, provider routes, and extends fit together

Why

Profiles previously inherited every declaration from default, forcing independent secret sets to use repetitive scopes or avoid useful field inheritance. SOPS writes also nested convention secrets by project and profile without making that destination obvious before a write.

This keeps inheritance control local to the affected secret and makes write behavior visible before secret input is requested.

Validation

• cargo test --workspace --all-features
• npm --prefix docs run build
• release CLI integration suite
• commit hooks: clippy and rustfmt

[alanscodelog]

I have only read your quick summary not the full changes, but regarding "add per-secret inherit = false for declarations in [profiles.default]"

This does not really help for me personally for any of my secrets because I'm using default profile to mean "dev" and I have a prod profile extending "dev" which extends 99% of it's secrets. But it's the other profiles I don't want extending default, they have nothing to do with dev or prod secrets. Currently I am using a scope to further "narrow" them to only their secrets.

I was thinking something more like this, where the extending profile says, hey no, don't inherit secrets from default, I'm a standalone profile or whatever you want to call it.

[profiles.normally-extending-profile.defaults]
inherit = false # do not inherit default's secrets.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	fc90cec	Commit Preview URL Branch Preview URL	Aug 04 2026, 07:16 PM