fix(#528): start custody maintenance on the in-process path too #536

Merged

Cordy merged 2 commits from fix-528c into main

2026-09-14 01:46:56 +00:00

Cordy commented

2026-09-14 01:45:52 +00:00

Owner

v0.6.189 wired StartMaintenance into buildKeys — which only the standalone crypto role (#33) calls. In-process instances (both dogfoods) construct their OpenBaoKeys inside buildEncryption's own near-duplicate custody switch, so the live v0.6.189 boot log showed no custody self-check line: the feature shipped wired to the wrong door. Caught by verifying the deployed boot log rather than trusting the green suite — a wiring gap in main is exactly what unit tests can't see.

buildEncryption's openbao case now constructs the provider, starts maintenance, and hands it to encrypt.New. The buildKeys/buildEncryption duplication (recovery parsing and the custody switch exist twice) is noted on #528 as a refactor candidate — it's what made this miss possible.

Verification after deploy: boot log must show custody self-check ok token_ttl=… renewable=true, and /metrics must carry the three cairn_custody_* series.

v0.6.189 wired `StartMaintenance` into `buildKeys` — which only the standalone crypto role (#33) calls. In-process instances (both dogfoods) construct their `OpenBaoKeys` inside `buildEncryption`'s own near-duplicate custody switch, so the live v0.6.189 boot log showed no `custody self-check` line: the feature shipped wired to the wrong door. Caught by verifying the deployed boot log rather than trusting the green suite — a wiring gap in `main` is exactly what unit tests can't see. `buildEncryption`'s openbao case now constructs the provider, starts maintenance, and hands it to `encrypt.New`. The `buildKeys`/`buildEncryption` duplication (recovery parsing and the custody switch exist twice) is noted on #528 as a refactor candidate — it's what made this miss possible. Verification after deploy: boot log must show `custody self-check ok token_ttl=… renewable=true`, and `/metrics` must carry the three `cairn_custody_*` series.

Cordy added 2 commits

2026-09-14 01:45:54 +00:00

one-shot: #528 - wire StartMaintenance into buildEncryption (the path dogfoods take) 717245e811

fix(#528 ): start custody maintenance on the in-process path too

ci / test-and-build (pull_request) Successful in 52s

Details

4eeec4520a

v0.6.189 wired StartMaintenance into buildKeys, which only the
standalone crypto role (#33) calls. In-process instances - both
dogfoods - construct their OpenBaoKeys inside buildEncryption's own
near-duplicate custody switch, so the live boot log showed no
custody self-check line: the feature shipped wired to the wrong
door. Caught by verifying the deployed boot log rather than trusting
the green suite; a wiring gap in main is exactly the thing unit
tests do not see.

buildEncryption's openbao case now constructs the provider, starts
maintenance, and hands it to encrypt.New. The buildKeys/
buildEncryption duplication (recovery parsing and the custody
switch exist twice) is a refactor candidate noted on #528.

Cordy scheduled this pull request to auto merge when all checks succeed

2026-09-14 01:45:59 +00:00