The backup gate is only as trustworthy as the sealers; internal/sink was the
safety-critical coverage gap blocking all real rotation work.
sealer_test.go: round-trip per sealer (age/hmac/openssl) across ascii/binary/
unicode/empty/large payloads, asserting plaintext never leaks into sealed
output; tamper fails closed (age & hmac error with zero bytes emitted on a
flipped ciphertext or MAC byte); openssl's unauthenticated failure mode pinned
as an executable contract (no exact-plaintext recovery only); wrong-passphrase
clean-error; short-bundle, bad-binary, and empty-passphrase error paths.
framing_test.go: bundle framing (zero-record, clean-EOF, truncated mid-path/
len/secret, oversized path); gopass wrapper Insert/InsertAt/Show/Exists/
Available; secret-never-in-argv leak assertion (Hard Rule #3); gopass-failure
paths surface errors instead of silently short backups; end-to-end export ->
seal -> open -> count -> restore proving completeness + authenticity together.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
An env credential's Identity (".env / API_TOKEN") produced StorePath
imported/env/.env/api_token; gopass hides dot-prefixed segments from
`ls --flat`, so those entries were invisible to bundle.ListPaths and the
mandatory backup gate silently under-covered them (Hard Rule #1 violation).
slug() now strips leading dots per /-separated segment so incredigo can no
longer write a path that `ls --flat` hides. Locked in by
TestStorePathNoDotSegment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Design-phase foundation for v2 rotation. Changes NO credential at any service.
- internal/rotate: Rotator interface + registry + PlanAll (zero drivers
registered, so every credential plans as "(none)")
- internal/rotate.Snapshot: the MANDATORY backup gate — seals the gopass
prefix into an authenticated bundle, re-opens it, and confirms the entry
count matches before returning; any failure blocks rotation
- internal/sink.CountBundleRecords: read-only bundle completeness check
- cmd: `incredigo rotate` runs the backup gate + prints the plan; it is
dry-run only and refuses --execute (design phase)
- tests: backup gate happy path, no-overwrite, tamper detection; race-clean
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
leetcrypt