Ruleloaded every turn

Secret hygiene, wherever files are tracked

Never put tokens, passwords, API keys, or secrets in any file that is committed to source control — rule files, docs, source, config, comments, docstrings, commit messages, story files and planning artifacts alike.
Read credentials from the environment, never inline. Cloud CLIs resolve them from a profile or a secret store; use --profile or an environment variable, never a pasted key.
On finding a secret in source control, stop. Commit nothing on top; tell the user immediately so the credential is rotated first; then remove it, then rewrite history if warranted.
Add a secret-bearing file to .gitignore before creating it. An already-tracked file stays tracked when its directory is later ignored — check git ls-files. Never git add one.
Why, and the shell examples: docs/how-it-works.md.