docs: def diff(vault_client, opt):
      """Derive a comparison between what is represented in the Secretfile
      and what is actually live on a Vault instance"""
      if opt.thaw_from:
          opt.secrets = tempfile.mkdtemp('aomi-thaw')
          auto_thaw(vault_client, opt)
  
      ctx = Context.load(get_secretfile(opt), opt) \
                   .fetch(vault_client)
  
      for backend in ctx.mounts():
          diff_a_thing(backend, opt)
  
      for resource in ctx.resources():
          diff_a_thing(resource, opt)
  
      if opt.thaw_from:
          rmtree(opt.secrets)