Shannon Sands 22aadaa56f fix(gateway): source external precedence from refresh inputs, not value equality ... Reworks the refresh path to use explicit external-managed names supplied by gateway orchestration, instead of trying to infer ownership transitions from env var value equality. Changes: - KeystoreClient.inject_env() now accepts external_managed_names for force refreshes. - Gateway refresh computes external-managed names from .env for the current cycle and passes them into keystore injection. - Revocation now clears deleted keystore-backed vars only when they are not externally managed this cycle. Regression coverage added for: - external replacement with different value surviving delete+refresh - external replacement with the SAME value surviving delete+refresh - deleted keystore secret being revoked when no external source replaces it Validation: 140 targeted tests passing		2026-03-29 08:38:29 +10:00
..
__init__.py	feat: add encrypted keystore for secret management	2026-03-29 08:38:21 +10:00
categories.py	feat: add encrypted keystore for secret management	2026-03-29 08:38:21 +10:00
cli.py	feat: add encrypted keystore for secret management	2026-03-29 08:38:21 +10:00
client.py	fix(gateway): source external precedence from refresh inputs, not value equality	2026-03-29 08:38:29 +10:00
credential_store.py	fix(wallet): harden keystore fallback, persist policy/history, wire gateway injection	2026-03-29 08:38:29 +10:00
store.py	fix(gateway): inject keystore secrets without config.yaml and on refresh	2026-03-29 08:38:29 +10:00