# Railway hardener

Run `av harden railway` to apply this hardener and `av doctor railway` to verify it.

`av harden railway` installs the signed Railway Isotope and migrates legacy or
OAuth credentials from the production, staging, and development config files
into environment-and-host-bound Automic Vault Secrets. The files retain user
and project metadata plus reserved non-secret `@av` markers.

The patched Target routes session reads, login and refresh stores, and logout or
invalid-grant deletes through fixed Railway-only XPC operations. Each operation
binds the live Target, complete arguments, Railway environment, host, and
derived Secret Name.

Unsupported user fields, mixed legacy/OAuth credentials, partial markers, and
incomplete sessions fail without changing any config file. The authorized
Target receives reusable session material in memory; the Hardener cannot
protect it after Secret Application.