Assisted-by: GLM-5.1 via pi

diff --git a/quire-server/src/ci/error.rs b/quire-server/src/ci/error.rs
index 62daaa4..a464723 100644
--- a/quire-server/src/ci/error.rs
+++ b/quire-server/src/ci/error.rs
@@ -4,8 +4,8 @@ use miette::Diagnostic;
 
 use super::pipeline::PipelineError;
 use super::run::RunState;
-use crate::fennel::FennelError;
-use crate::secret;
+use quire_core::fennel::FennelError;
+use quire_core::secret;
 
 /// Errors produced by CI operations.
 #[derive(Debug, thiserror::Error, Diagnostic)]
diff --git a/quire-server/src/ci/mirror.rs b/quire-server/src/ci/mirror.rs
index 1a9cfcd..9d7f394 100644
--- a/quire-server/src/ci/mirror.rs
+++ b/quire-server/src/ci/mirror.rs
@@ -237,7 +237,7 @@ mod tests {
     use crate::ci::pipeline::{Diagnostic, RustRunFn, compile};
     use crate::ci::run::RunMeta;
     use crate::ci::runtime::{ExecutorRuntime, RuntimeHandle};
-    use crate::secret::{Error as SecretError, SecretString};
+    use quire_core::secret::{Error as SecretError, SecretString};
 
     /// Set up a bare git repo with one commit. Returns the tempdir,
     /// the bare repo path, and the head SHA.
diff --git a/quire-server/src/ci/mod.rs b/quire-server/src/ci/mod.rs
index 8865a52..f323bf5 100644
--- a/quire-server/src/ci/mod.rs
+++ b/quire-server/src/ci/mod.rs
@@ -156,7 +156,7 @@ fn trigger_ref(
     db_path: &Path,
     pushed_at: jiff::Timestamp,
     push_ref: &PushRef,
-    secrets: &HashMap<String, crate::secret::SecretString>,
+    secrets: &HashMap<String, quire_core::secret::SecretString>,
     executor: run::Executor,
 ) -> error::Result<()> {
     let ci = repo.ci();
diff --git a/quire-server/src/ci/pipeline.rs b/quire-server/src/ci/pipeline.rs
index b284a79..fb5977e 100644
--- a/quire-server/src/ci/pipeline.rs
+++ b/quire-server/src/ci/pipeline.rs
@@ -13,7 +13,7 @@ use petgraph::visit::{Bfs, Reversed};
 
 use super::error::Result;
 use super::registration::{self, Registrations};
-use crate::fennel::Fennel;
+use quire_core::fennel::Fennel;
 
 /// A registration-time error caught while individual `(ci.job …)` and
 /// `(ci.image …)` calls are being processed.
diff --git a/quire-server/src/ci/registration.rs b/quire-server/src/ci/registration.rs
index b452db1..4a25939 100644
--- a/quire-server/src/ci/registration.rs
+++ b/quire-server/src/ci/registration.rs
@@ -17,7 +17,7 @@ use miette::NamedSource;
 use super::error::Result;
 use super::mirror;
 use super::pipeline::{self, DefinitionError, Diagnostic, Job, PipelineError, RunFn};
-use crate::fennel::Fennel;
+use quire_core::fennel::Fennel;
 
 /// Output of [`register`]: jobs and image successfully registered
 /// from the script. Definition-time errors are returned via the `Err`
diff --git a/quire-server/src/ci/run.rs b/quire-server/src/ci/run.rs
index db4a5c0..00cc0f4 100644
--- a/quire-server/src/ci/run.rs
+++ b/quire-server/src/ci/run.rs
@@ -16,7 +16,7 @@ use super::error::{Error, Result};
 use super::pipeline::{Pipeline, RunFn};
 use super::runtime::{ExecutorRuntime, Runtime, RuntimeHandle, ShOutput};
 use crate::display_chain;
-use crate::secret::SecretString;
+use quire_core::secret::SecretString;
 
 /// The execution mode for a run. Host runs `sh` directly on the host.
 /// Docker materializes a container and routes `sh` through `docker exec`.
diff --git a/quire-server/src/ci/runtime.rs b/quire-server/src/ci/runtime.rs
index 5f75d10..0833d86 100644
--- a/quire-server/src/ci/runtime.rs
+++ b/quire-server/src/ci/runtime.rs
@@ -15,7 +15,7 @@ use mlua::{IntoLua, Lua, LuaSerdeExt};
 
 use super::pipeline::{Job, Pipeline};
 use super::run::{DockerLifecycle, RunMeta};
-use crate::secret::{SecretRegistry, SecretString, redact};
+use quire_core::secret::{SecretRegistry, SecretString, redact};
 /// Per-sh timing: (index, started_at, finished_at).
 pub(super) type ShTimings = Vec<(usize, Timestamp, Timestamp)>;
 
@@ -199,7 +199,7 @@ impl Runtime {
     /// trace or log it directly. See [`SecretRegistry::resolve`] for
     /// the full caveat.
     ///
-    /// [`SecretRegistry::resolve`]: crate::secret::SecretRegistry::resolve
+    /// [`SecretRegistry::resolve`]: quire_core::secret::SecretRegistry::resolve
     pub(super) fn secret(&self, name: &str) -> super::error::Result<String> {
         self.registry.borrow_mut().resolve(name).map_err(Into::into)
     }
diff --git a/quire-server/src/error.rs b/quire-server/src/error.rs
index f39075c..a581a9b 100644
--- a/quire-server/src/error.rs
+++ b/quire-server/src/error.rs
@@ -1,8 +1,8 @@
 use miette::Diagnostic;
 
 use crate::ci::Error as CiError;
-use crate::fennel::FennelError;
-use crate::secret;
+use quire_core::fennel::FennelError;
+use quire_core::secret;
 
 #[derive(Debug, thiserror::Error, Diagnostic)]
 pub enum Error {
@@ -77,7 +77,7 @@ impl From<FennelError> for Error {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::fennel::FennelError;
+    use quire_core::fennel::FennelError;
 
     #[test]
     fn from_fennel_error() {
@@ -94,7 +94,7 @@ mod tests {
         // FennelError::Eval has a top-level message of just the
         // filename and an mlua::Error in its source — the exact case
         // the helper is meant to fix.
-        let f = crate::fennel::Fennel::new().expect("Fennel::new");
+        let f = quire_core::fennel::Fennel::new().expect("Fennel::new");
         let result: std::result::Result<i32, _> = f.load_string("(this is not valid", "bad.fnl");
         let fennel_err = result.unwrap_err();
 
diff --git a/quire-server/src/lib.rs b/quire-server/src/lib.rs
index 85bf264..1b72414 100644
--- a/quire-server/src/lib.rs
+++ b/quire-server/src/lib.rs
@@ -2,9 +2,7 @@ pub mod ci;
 pub mod db;
 mod error;
 pub mod event;
-pub use quire_core::fennel;
 pub mod quire;
-pub use quire_core::secret;
 
 pub use error::Error;
 pub use error::Result;
diff --git a/quire-server/src/quire/mod.rs b/quire-server/src/quire/mod.rs
index 8884ea0..0fb6ccb 100644
--- a/quire-server/src/quire/mod.rs
+++ b/quire-server/src/quire/mod.rs
@@ -7,9 +7,9 @@ use miette::{Context, IntoDiagnostic, Result, ensure};
 pub mod web;
 
 use crate::ci::{Ci, Runs};
-use crate::fennel::Fennel;
-use crate::secret::SecretString;
 use crate::{Error, Result as AppResult};
+use quire_core::fennel::Fennel;
+use quire_core::secret::SecretString;
 
 /// Parsed global configuration (`/var/quire/config.fnl`).
 ///
diff --git a/quire-server/tests/property.rs b/quire-server/tests/property.rs
index e2299c0..837f7d0 100644
--- a/quire-server/tests/property.rs
+++ b/quire-server/tests/property.rs
@@ -4,7 +4,7 @@ use hegel::TestCase;
 use hegel::generators::{integers, just, text, vecs};
 use hegel::one_of;
 use quire::event::{PushEvent, PushRef};
-use quire::secret::{SecretRegistry, SecretString, redact};
+use quire_core::secret::{SecretRegistry, SecretString, redact};
 
 const ZERO_SHA: &str = "0000000000000000000000000000000000000000";