I like the idea. As author of the contracts RFC, I’m all for adding interfaces to decouple the code, allowing for multiple backends to fulfill the same role and let the end user choose their preferred backend.
At the start of the blog post, you showed a table summarizing the various mechanisms used to pass secrets for NixOS modules. I assumed somehow SecretsSpec would help those modules that implement a less ideal or just plainly wrong mechanism. Am I understanding SecretsSpec correctly in that it must be implemented in the upstream service directly and cannot be bolted on in the NixOS module?