#528 finish: custody status on the admin card, KV path escaping, provider dedup (v0.6.191) #537

Merged

Cordy merged 8 commits from fix-528d into main

2026-09-14 02:21:18 +00:00

Cordy commented

2026-09-14 02:20:07 +00:00

Owner

Closes out the remaining #528 scope:

Encryption & keys card — custody token state. encryptionPayload now emits custodyStatus (errors, ttlSeconds, renewable, lastError) for OpenBao custody while the maintenance loop is active, sourced from encrypt.CustodyStats()/CustodyLastError(). The custody pane renders a Custody token row (renews itself / cannot renew / does not expire, with a TTL badge) and a Last custody error row when one exists. i18n ×4. Numbers only — the no-secrets rule holds, the token itself never reaches the payload.
Per-segment KV path escaping. url(rel) escaped nothing, so a #, % or ? in a user or space name corrupted the request URL (% even made it unparseable). Each segment now goes through url.PathEscape.
buildEncryption dedup. Collapsed to encrypt.New(store, buildKeys(cfg, log)) — the near-duplicate switch was how the v0.6.189 maintenance wiring missed the in-process path. Bodies were verified token-identical before the collapse.

TDD: red witnessed on the runner (URL corruption + missing custodyStatus), then green with the full suite and the #389 fence/node gates passing. CHANGELOG v0.6.191.

Closes out the remaining #528 scope: - **Encryption & keys card — custody token state.** `encryptionPayload` now emits `custodyStatus` (errors, ttlSeconds, renewable, lastError) for OpenBao custody while the maintenance loop is active, sourced from `encrypt.CustodyStats()`/`CustodyLastError()`. The custody pane renders a Custody token row (renews itself / cannot renew / does not expire, with a TTL badge) and a Last custody error row when one exists. i18n ×4. Numbers only — the no-secrets rule holds, the token itself never reaches the payload. - **Per-segment KV path escaping.** `url(rel)` escaped nothing, so a `#`, `%` or `?` in a user or space name corrupted the request URL (`%` even made it unparseable). Each segment now goes through `url.PathEscape`. - **buildEncryption dedup.** Collapsed to `encrypt.New(store, buildKeys(cfg, log))` — the near-duplicate switch was how the v0.6.189 maintenance wiring missed the in-process path. Bodies were verified token-identical before the collapse. TDD: red witnessed on the runner (URL corruption + missing custodyStatus), then green with the full suite and the #389 fence/node gates passing. CHANGELOG v0.6.191.

Cordy added 8 commits

2026-09-14 02:20:08 +00:00

scout: buildKeys vs buildEncryption diff, encryption payload, admin card render 8e02773142

diag: buildEncryption tail + renderEncCustody body 9269534d54

one-shot: #528d red - url escaping + custody payload tests 9f1d4872b9

test(#528 ): url segment escaping + custody status in encryption payload (red) a78df4db90

Witnessed failing on the runner for the right reasons: the fetch
path drops everything after '#' in a group name (the fragment eats
it), and encryptionPayload has no custodyStatus yet.

diag: print buildKeys/buildEncryption, renderEncCustody, i18n anchors (never commits) a194a4c34f

one-shot: #528d green - escaping, custody card, dedup (v0.6.191) f72308b75e

feat(#528 ): custody status on the admin card, path escaping, provider dedup fd7c6b411d

- openbao url(rel) escapes each segment (a '#', '%' or '?' in a user
  or space name corrupted the KV request path)
- encryptionPayload emits custodyStatus (errors, ttlSeconds,
  renewable, lastError) for openbao custody while maintenance is
  active; Encryption & keys card renders token state + last error,
  i18n x4
- buildEncryption collapsed to encrypt.New(store, buildKeys(...)) -
  removes the duplicate switch that hid the v0.6.189 wiring gap

Closes the remaining #528 scope. CHANGELOG v0.6.191.

chore: remove diag one-shot (never commits, needs explicit cleanup)

ci / test-and-build (pull_request) Successful in 54s

Details

6c472fb025

Cordy scheduled this pull request to auto merge when all checks succeed

2026-09-14 02:20:13 +00:00