Build Log
Aug 2026 build
Gave every credential one source of truth, and made the sync prove itself
After a rotation silently invalidated a recovery bundle, the local env file is now rendered from a 1Password vault instead of hand-edited. 109 variables seeded into 44 items, verified 109 of 109 match.
109/109 match, first pull changed nothing
1PasswordBash
Every recovery drill run between rotations could not have passed, and nothing said so. The evals for the fix were written red first, and one caught a real bug before ship: a cleanup step eaten by a subshell was leaving secret temp files on disk. My secrets have one source of truth, and the sync proves itself.