bretton.dev / tidepool
Read-only ActivityPub → atproto bridge for the threadiverse using Coves lexicons
Star
Fork 0
Watch

test(identity): pin the boot canary and its dual-read rescue master

A wrong-KEK LoadOrCreateRotationKey errors without minting a fresh escrow key — this is the assertion tier for main.go's unconditional boot-time call, which fails the process before traffic is served. The rescue half pins that NewCustodianWithPrevious(new, old) is the legitimate way past the canary mid-rotation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author Bretton Co-author Claude Fable 5 Date Commit 64c2ee4a Parent aaaa20db
+119
1 changed file