The backup gate is only as trustworthy as the sealers; internal/sink was the
safety-critical coverage gap blocking all real rotation work.
sealer_test.go: round-trip per sealer (age/hmac/openssl) across ascii/binary/
unicode/empty/large payloads, asserting plaintext never leaks into sealed
output; tamper fails closed (age & hmac error with zero bytes emitted on a
flipped ciphertext or MAC byte); openssl's unauthenticated failure mode pinned
as an executable contract (no exact-plaintext recovery only); wrong-passphrase
clean-error; short-bundle, bad-binary, and empty-passphrase error paths.
framing_test.go: bundle framing (zero-record, clean-EOF, truncated mid-path/
len/secret, oversized path); gopass wrapper Insert/InsertAt/Show/Exists/
Available; secret-never-in-argv leak assertion (Hard Rule #3); gopass-failure
paths surface errors instead of silently short backups; end-to-end export ->
seal -> open -> count -> restore proving completeness + authenticity together.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt
826d804bd9