Render
The config each env gets
Overlays, defaults and env files resolved into the final values.
Four commands
Render, diff, mask, gate.
Diff
Against what runs now
Compared with the live config, key by key, not file by file.
Mask
Secrets stay masked
A changed secret shows as changed, with a short hash. Its value never prints.
Gate
Unreviewed changes fail
A prod change without a review exits 1, in any CI that runs a container.