Repository navigation
fix(bep): fail a secret-tool call whose output pipe stays open
PASS
Governs (arch 15b603e6, found by search because the checkout has no arch-map.md): Gatehouse §6.10 line 837 makes hardware custody a SHOULD where the host offers it, and names TPM 2.0 for Linux. §6.10 line 832 says the sealing key is immutable except by re-enrollment. Design principle 7, architecture.md line 337, is safe by default. The repo spec 24-spec-box-egress-proxy BEP-088 to BEP-090 records the owner's Secret Service fallback of 2026-11-12. It also calls a Secret Service key "the one exception" to the release custody rule (spec line 265, and BEP-059).
Baseline and compare. The last ruled head is 7da04290 (CONDITIONS, this PR). The ledger cuts that ruling at 400 characters, so I read the revise commits to see what each round fixed. Every round closed one fail-open path in the secret-tool lookup. The compare to 167aa388 closes the last two. run() now returns an error when an output pipe is still open after secret-tool exits, and it never uses partial output as the answer. lookup() now reads exit 0 with no secret as an unreadable item, not as an empty slot. Each case has a test. The compare also carries a merge from main (finalize_install.rs, cli-min.md). That merge is not part of pr.diff, and I did not rule on it.
Ruling. The store is in the owner the task names: crates/bep/src/secret_service.rs, Linux only. It holds the key as signin.rs holds the sign-in. The private half goes to secret-tool on stdin, not in argv, and the buffers are zeroized. A locked keyring and an unreachable Secret Service are separate KeyErrors. StartError::from_store turns each into a refusal that names no replacement and keeps the keys, as line 832 requires for the sealing key. Each path that cannot decide refuses (principle 7). The load and generate log lines carry role, fingerprint and store=secret-service, as the task's observability line asks. BEP-089 conforms, and nothing is left to condition.
Noted, not a condition. SecretServiceKey::exportable() returns false, so custody() reads the key as Held. The private half of a Secret Service key can be copied. The spec makes this store the one exception to the release rule, and BEP-090 owns the report of reduced custody. All four earlier rulings on this PR let this stand, and I follow them. When BEP-090 lands, check that min auth status takes custody from the published store field and not from exportable().
Not checked. I did not compile or run the tests, as the contract requires. I did not test the classification of secret-tool stderr phrases against a real libsecret. gh is not available here, so I could not confirm the issue for the BEP-088 task that wires this store into bep serve.
Ruled at 167aa38 against gominimal/arch@15b603e6afb8 by claude-opus-5-5; arch_rulings 1206, job 51776a4e-d32c-45f4-a7aa-3fc3e9b29953.