Files
hermes-agent/tests
Shannon Sands 22aadaa56f fix(gateway): source external precedence from refresh inputs, not value equality
Reworks the refresh path to use explicit external-managed names supplied by
gateway orchestration, instead of trying to infer ownership transitions from
env var value equality.

Changes:
- KeystoreClient.inject_env() now accepts external_managed_names for force
  refreshes.
- Gateway refresh computes external-managed names from .env for the current
  cycle and passes them into keystore injection.
- Revocation now clears deleted keystore-backed vars only when they are not
  externally managed this cycle.

Regression coverage added for:
- external replacement with different value surviving delete+refresh
- external replacement with the SAME value surviving delete+refresh
- deleted keystore secret being revoked when no external source replaces it

Validation: 140 targeted tests passing
2026-03-29 08:38:29 +10:00
..