@tpsdev-ai/flair 0.38.0 → 0.39.0

package/dist/lib/secrets-push.js

@@ -8,11 +8,11 @@
  * otherwise. That is wrong in both directions and was wrong in both directions
  * on the day it was replaced:
  *
- *   - tps.dtrt.harperfabric.com runs Harper 5.1.26 and has NO secrets
+ *    - tps.dtrt.harperfabric.com runs Harper 5.1.26 and has NO secrets
  *     operations — measured, `set_secret` answers "Operation 'set_secret' not
  *     found", identical to an operation that does not exist at all — and was
  *     selected for the automated mechanism because of its name.
- *   - a self-hosted Harper 5.2 with the Pro env-secrets component is fully
+ *    - a self-hosted Harper 5.2 with the Pro env-secrets component is fully
  *     capable and was sent down the manual Fabric Studio path because its
  *     hostname did not match.
  *
@@ -116,9 +116,26 @@ export async function pushSecrets(opsUrl, authHeader, vars, publicKeyPem, deps =
     const results = [];
     for (const [name, value] of Object.entries(vars)) {
         try {
-            const r = await opsCall(opsUrl, authHeader, { operation: "set_secret", name, envelope: sealSecret(value, publicKeyPem), tier: PROCESS_ENV_TIER }, fetchImpl);
+            const r = await opsCall(opsUrl, authHeader, { operation: "set_secret", name, envelope: sealSecret(value, publicKeyPem), processEnv: true }, fetchImpl);
             const err = String(r.json?.error ?? "").slice(0, 140);
-            results.push({ name, ok: r.ok, detail: r.ok ? undefined : `HTTP ${r.status}${err ? `: ${err}` : ""}` });
+            if (!r.ok) {
+                results.push({ name, ok: false, detail: `HTTP ${r.status}${err ? `: ${err}` : ""}` });
+                continue;
+            }
+            // Read back one pushed row to verify processEnv actually materialised.
+            // A 200 from set_secret is not proof — core silently ignores unknown
+            // params, so the row can be accepted and still land inert.
+            const verify = await opsCall(opsUrl, authHeader, { operation: "search_by_value", database: "system", table: "hdb_secret", search_attribute: "name", search_value: name, get_attributes: ["name", "processEnv"] }, fetchImpl);
+            if (!verify.ok) {
+                results.push({ name, ok: false, detail: `push returned 200 but verify failed HTTP ${verify.status}` });
+                continue;
+            }
+            const row = Array.isArray(verify.json) ? verify.json[0] : verify.json?.[0];
+            if (!row || row.processEnv !== true) {
+                results.push({ name, ok: false, detail: `push returned 200 but read-back shows processEnv is ${row?.processEnv ?? "missing"}, not true — secret is inert` });
+                continue;
+            }
+            results.push({ name, ok: true });
         }
         catch (err) {
             results.push({ name, ok: false, detail: String(err?.message ?? err).slice(0, 140) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "packageManager": "bun@1.3.10",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",