Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/secret/set.go`:
- Around line 99-132: Update findGlobalSetContext to validate each global
declaration’s effective backend coordinate using its component context, rather
than comparing raw declarations alone. Resolve or reject declarations whose
Declaration.Reference depends on atmos_component, and return the existing
componentRequiredForSet error when effective coordinates differ; add coverage
for identical component-dependent declarations.

In `@pkg/function/parser/parser.go`:
- Around line 375-389: Track path-option presence separately from result.Path in
the parser handling around the path and raw cases, so an explicitly empty path
is distinguishable from an omitted path. Update the mutual-exclusion check to
reject raw whenever path was specified, including path "", and add a regression
case for SERVICE_CONFIG | path "" | raw.

In `@pkg/store/providers/google_secret_manager_store.go`:
- Around line 478-484: Add direct unit-test cases for GSMStore.GetRaw covering
both JSON and non-JSON secret payloads. Assert the returned value exactly
matches the backend payload, including its original encoding and content,
without decoding or transformation; retain existing error assertions and use the
established GSM test fixtures and backend mocks.

In `@pkg/store/providers/keychain_store.go`:
- Around line 163-166: Update the JSON string decoding in GetRaw to unmarshal
into a string pointer, returning the decoded value only when the pointer is
non-nil. Preserve the original raw payload for JSON null while retaining the
existing return behavior for non-null strings.

---

Outside diff comments:
In `@cmd/secret/enumerate.go`:
- Around line 98-114: Update the scope-entry sorting used before
findGlobalSetContext to compare ComponentType after Stack and Component,
ensuring entries with identical names have deterministic ordering. Add a
regression test covering identical component names across two component types
and verify the selected context remains consistent.

In `@pkg/secrets/resolver.go`:
- Around line 68-88: The error handling in the resolver’s raw retrieval flow
must not apply opts.Default when the provider returns
providers.ErrRawNotSupported; restrict the default fallback to missing-secret
errors and preserve ErrRawNotSupported through the existing wrapped result. Add
a resolver test covering raw | default with a structured-only provider.

---

Nitpick comments:
In `@cmd/secret/set_test.go`:
- Around line 127-194: Refactor TestFindGlobalSetContext into a table-driven
test covering enumeration errors, missing matches, inconsistent declarations,
and identical declarations. Store each case’s scope entries, requested scope,
secret name, expected component/type, and expected error in the test table, then
run them through a single subtest loop while preserving the existing assertions
and overrideEnumerateScopes setup.

In `@pkg/function/parser/parser_test.go`:
- Around line 196-224: The TestParseSecret test should use a single table-driven
case list containing each valid and invalid input, expected SecretArgs, and
expected error status/details. Replace the separate assertions and invalid-input
loop while preserving the existing expectations, and add SERVICE_CONFIG | path
"" | raw as an invalid case.

In `@pkg/secrets/providers/provider.go`:
- Around line 73-74: Replace the locally constructed ErrRawNotSupported sentinel
with the corresponding static error defined in errors/errors.go, then expose or
wrap that catalog error from the provider boundary while preserving errors.Is
compatibility for callers.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/secret/set_test.go`:
- Around line 122-125: Update the test around runSecretSubcommand and its
loadServiceFn mock to capture the secretScope argument passed to the loader,
then assert that its ComponentType is "helm" in addition to the existing
call-count checks. Keep the assertion behavior-focused and table-driven if the
surrounding tests support that pattern.

In `@pkg/component/helm/secret_values_integration_test.go`:
- Line 52: Refactor
TestNativeHelmSecretRawAndStructuredValuesMaskIndentedMultilineValues into named
helpers so it stays under 60 lines and separates rendering from masking
assertions. In the fallback manifest path, use require.NotEmpty before accessing
containers[0], then validate manifest and container types with require.IsType
before asserting and reading env; ensure malformed fixtures fail through test
assertions rather than panicking.

In `@pkg/function/parser/parser.go`:
- Line 340: Correct the grammar comment for ParseSecret to show that path
expression and raw are alternatives rather than independently optional, matching
the validation that rejects using both together in the parser logic.

In `@pkg/secrets/providers/store_test.go`:
- Around line 106-129: Add a test alongside
TestStoreProvider_GetRawFallsBackForTextOnly using a mock store that implements
store.RawStore. Configure the raw-store method to return a raw payload, assert
GetRaw returns it without error, and do not set any Store.Get expectation so the
test verifies native RawStore delegation bypasses the fallback.

In `@pkg/store/providers/aws_secrets_manager_store.go`:
- Around line 296-311: Add repository-standard deferred perf.Track
instrumentation, using each method’s atmosConfig and fully qualified function
name, at the start of SecretsManagerStore.GetRaw in
pkg/store/providers/aws_secrets_manager_store.go:296-311, GSMStore.GetRaw in
pkg/store/providers/google_secret_manager_store.go:478-484, and
KeychainStore.GetRaw in pkg/store/providers/keychain_store.go:151-168; include
the required blank line after each instrumentation statement.

In `@pkg/store/providers/aws_ssm_param_store.go`:
- Around line 426-435: Update the inline comments above getKey and assumeRole in
the parameter-name retrieval flow so each comment ends with a period, without
changing the surrounding logic.

In `@pkg/store/providers/azure_keyvault_store.go`:
- Around line 369-389: Update AzureKeyVaultStore.GetRaw and Set to allow empty
stack and/or component values so getKey can resolve stack-scoped and global
coordinates consistently with GSMStore; retain key validation and existing error
handling. Ensure !secret NAME | raw works and component-less global writes are
supported, then add coverage for stack-scoped and global reads and writes.

---

Nitpick comments:
In `@cmd/secret/set_test.go`:
- Around line 127-194: Refactor TestFindGlobalSetContext into a table-driven
test covering the four existing context-resolution scenarios. Define each case
with its scope entries, enumeration error, expected component and component
type, and whether an error is expected; iterate with subtests, applying
overrideEnumerateScopes and invoking findGlobalSetContext once per case while
preserving the existing assertions and outcomes.

In `@pkg/function/parser/parser_test.go`:
- Around line 196-225: Convert TestParseSecret in
pkg/function/parser/parser_test.go (lines 196-225) into table-driven cases
covering each valid input with its expected SecretArgs or field assertions, plus
invalid inputs expecting errors. Also convert the raw, default, compact syntax,
conflict, and empty-name scenarios in pkg/secrets/resolver_test.go (lines
181-196) into a table-driven test, preserving each scenario’s existing
expectations.

In `@pkg/secrets/resolver_test.go`:
- Around line 154-173: Add a test alongside
TestResolve_RawDefaultDoesNotHideUnsupportedCapability that configures the mock
store to return the missing-secret error for DATADOG_API_KEY, then resolves the
raw secret expression with default "fallback" and asserts it returns "fallback"
without an error. Keep the existing unsupported-capability test unchanged.