TOTP cannot gate decryption in a serverless file-based secret manager — the 20-bit entropy and verification problems
Three crypto constraints prevent using a 6-digit TOTP code as a direct decryption credential in serverless file-based secret management. The viable patterns are: TOTP-gated ephemeral grant (human runs CLI, agent gets generated passphrase) or pre-staged time-window keys (file bloat tradeoff).
@mahmoud