From 7d113b524486648eaedecb9360164eff441bd1e2 Mon Sep 17 00:00:00 2001
From: Aly Raffauf <aly@aly.codes>
Date: Mon, 10 Aug 2026 08:00:52 -0400
Subject: [PATCH] refactor: name secret semantic operations

---
 internal/application/evaluation/semantics.go |  2 +-
 internal/reconcile/source_snapshot.go        | 24 ++++++++++----------
 internal/reconcile/source_snapshot_test.go   |  4 ++--
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/internal/application/evaluation/semantics.go b/internal/application/evaluation/semantics.go
index fae73f0..05c4fdf 100644
--- a/internal/application/evaluation/semantics.go
+++ b/internal/application/evaluation/semantics.go
@@ -82,7 +82,7 @@ func (semanticState *semanticState) secretSemanticFingerprints(ctx context.Conte
 		semantics.Target = deployment.SecretSemantic(content, semanticState.key)
 	}
 	if SecretDecryptionNeeded(record) {
-		source, err := record.Source.KeyedSemantic(ctx, semanticState.key)
+		source, err := record.Source.KeyedSecretSemantic(ctx, semanticState.key)
 		if err != nil {
 			return semantics, categorized(err, semanticState.commandLabel+": decrypt source "+record.File.SourceRepositoryPath)
 		}
diff --git a/internal/reconcile/source_snapshot.go b/internal/reconcile/source_snapshot.go
index 977c2e1..f488e2b 100644
--- a/internal/reconcile/source_snapshot.go
+++ b/internal/reconcile/source_snapshot.go
@@ -223,22 +223,22 @@ func sourceFacts(file deployment.ManagedFile, identity pathsafe.Identity, data [
 }
 
 // Snapshot returns the immutable facts captured from the source.
-func (o SourceObservation) Snapshot() SourceSnapshot { return o.snapshot }
+func (observation SourceObservation) Snapshot() SourceSnapshot { return observation.snapshot }
 
 // Bytes returns the captured bytes. Callers must not modify them and must
 // call Clear when the observation is no longer needed.
-func (o SourceObservation) Bytes() []byte { return o.bytes }
+func (observation SourceObservation) Bytes() []byte { return observation.bytes }
 
-// KeyedSemantic decrypts a secret only when semantic comparison is requested.
+// KeyedSecretSemantic decrypts a secret only when semantic comparison is requested.
 // The plaintext is cleared before returning, including when hashing succeeds.
-func (o *SourceObservation) KeyedSemantic(ctx context.Context, key [32]byte) (digest deployment.Digest, err error) {
-	if !o.secret {
-		return deployment.Digest{}, fmt.Errorf("reconcile: keyed semantics require a secret source %s", o.snapshot.path)
+func (observation *SourceObservation) KeyedSecretSemantic(ctx context.Context, key [32]byte) (digest deployment.Digest, err error) {
+	if !observation.secret {
+		return deployment.Digest{}, fmt.Errorf("reconcile: keyed semantics require a secret source %s", observation.snapshot.path)
 	}
-	if o.client == nil || len(o.bytes) == 0 {
-		return deployment.Digest{}, fmt.Errorf("reconcile: secret source %s cannot decrypt", o.snapshot.path)
+	if observation.client == nil || len(observation.bytes) == 0 {
+		return deployment.Digest{}, fmt.Errorf("reconcile: secret source %s cannot decrypt", observation.snapshot.path)
 	}
-	plaintext, err := o.client.Decrypt(ctx, o.bytes, o.relative)
+	plaintext, err := observation.client.Decrypt(ctx, observation.bytes, observation.relative)
 	if err != nil {
 		return deployment.Digest{}, err
 	}
@@ -247,7 +247,7 @@ func (o *SourceObservation) KeyedSemantic(ctx context.Context, key [32]byte) (di
 }
 
 // Clear zeroes and releases the retained capture buffer.
-func (o *SourceObservation) Clear() {
-	clear(o.bytes)
-	o.bytes = nil
+func (observation *SourceObservation) Clear() {
+	clear(observation.bytes)
+	observation.bytes = nil
 }
diff --git a/internal/reconcile/source_snapshot_test.go b/internal/reconcile/source_snapshot_test.go
index 02a7e38..c0bd464 100644
--- a/internal/reconcile/source_snapshot_test.go
+++ b/internal/reconcile/source_snapshot_test.go
@@ -197,7 +197,7 @@ func testSourceDecrypt(t *testing.T) {
 		t.Fatal("capture decrypted before keyed semantics")
 	}
 	var key [32]byte
-	digest, err := observation.KeyedSemantic(context.Background(), key)
+	digest, err := observation.KeyedSecretSemantic(context.Background(), key)
 	if err != nil || digest != deployment.SecretSemantic([]byte("plain"), key) {
 		t.Fatalf("keyed semantic = %v, %v", digest, err)
 	}
@@ -219,7 +219,7 @@ func testSourceKeyedOrdinary(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, err := observation.KeyedSemantic(context.Background(), [32]byte{}); err == nil {
+	if _, err := observation.KeyedSecretSemantic(context.Background(), [32]byte{}); err == nil {
 		t.Fatal("ordinary source accepted keyed semantics")
 	}
 }
-- 
2.51.2