Directory level metadata

Hello there. Gonna start by saying I've really been enjoying working with sops, thank you for all your work!

One sticking point that comes up is working with tools that expect some "layout" of files in a directory, with domain specific structure expected of the file contents. Such tools are often fairly intolerant of the metadata SOP introduces, even when not performing operations that actually care about the encrypted values. So before you invoke one of these tools, you generally have to copy everything out into a temporary directory somewhere, decrypting each file as appropriate. It's also your responsibility to clean up the decrypted directory and ensure appropriate permissions etc.

Would it make any sense to track the sops metadata for each structured file containing encrypted leaf values in a dedicated out-of-band file that lives in some discoverable location in the directory?

This would facilitate workflows like a hypothetical sops mount in which an entire directory is decrypted and presented for consumption (by e.g. the aforementioned tools) or editing. As a kinda sorta benefit, I believe this would also lift the restriction against top-level arrays.

No file, test, or entry point is named. Begin by locating the existing metadata and directory or CLI workflows, then define the out-of-band format, discovery rules, permissions, cleanup behavior, compatibility, and top-level-array handling before implementation.