Module init 

rk init: land a technology’s deterministic files into a target.

A front over the direct writer: the target’s evidence is gathered once, this binary’s projection is computed from its embedded sources, every destination is decided by elementary ownership, and on --apply the writer lands the files and the receipt last under one target lock. Dry-run by default: without --apply the destinations and what a fresh production invocation would do with them are listed and nothing is touched; rk stage is the full-byte comparison surface, and --stage lands the answers a stage resolved. A whole-file destination present on disk with no receipt naming it is a conflict: it refuses before any write, every collision collected in one pass, unless --replace names it, which saves its bytes first.

SATISFIES landing:a-landing-leaves-a-record SATISFIES landing:a-missing-receipt-is-a-classification

Functions

report_moved_secrets

Print each secret a replaced GitHub workflow moves, before the write, so the operator stores a new one before the rendered workflow runs.

run

Land the files for --tech into --target.