Secretive is a macOS application that stores SSH private keys in the Apple Secure Enclave (or on smart cards such as YubiKeys) and exposes them through an SSH agent, making private key material non-exportable by hardware design. The architecture is a main SwiftUI management app (Secretive) plus a background login-item agent (SecretAgent) that owns a Unix socket at ~/Library/Containers/.../socket.ssh. SSH clients connect to this socket; the agent parses the SSH agent wire protocol, matches the requested key, enforces the key's access-control policy (Touch ID, Apple Watch, or password), has the Secure Enclave produce the signature, and returns an OpenSSH-formatted response. All untrusted input parsing (agent messages, certificate files) is delegated to sandboxed XPC services with hard-coded code-signing requirements, and network access for update checks is isolated to a dedicated XPC service with a declared Internet Access Policy. The code is Swift 6 with strict concurrency, strict memory safety, and warnings-as-errors, and has zero third-party dependencies by explicit project policy. The codebase is organized into small Swift packages: SecretKit (protocols and type erasers for secrets/stores), SecureEnclaveSecretKit and SmartCardSecretKit (concrete key stores), SSHProtocolKit (binary encoding/decoding of OpenSSH keys, certificates, signatures, and the agent protocol), SecretAgentKit (the agent, socket controller, authentication batcher, request-provenance tracer), XPCWrappers (a typed Codable RPC layer over NSXPCConnection), SettingsKit (keychain-backed settings), and Brief (semver update checking). Several of these are cleanly isolated: OpenSSHReader, SemVer, the FormatStyle data formatters, the keychain-backed SettingsStore, and the typed XPC session wrapper could be lifted into new projects largely untouched. The signature writer's mpint encoding correctly handles OpenSSH's signed-bignum rules (stripping leading zero bytes, prefixing 0x00 when the sign bit is set), which is subtle and covered by dedicated tests. Tests use real captured binary fixtures for protocol compatibility and cover agent identity listing, signing, witness objection behavior, authentication batching, and update selection logic. CI runs tests, CodeQL, nightly notarized builds, and attestation-backed auditable releases. Minor soft spots include duplicated certificate-migration code, two different SecretAgent entry points (SwiftUI App and AppDelegate), and a parsed-but-disabled session-bind extension, indicating ongoing refactoring rather than architectural debt.