fix: preserve deterministic runtime secret leases

2026-08-14 17:47:17 +02:00
parent fd3b62ce6f
commit a94df262f4
4 changed files with 82 additions and 16 deletions
@@ -458,6 +458,7 @@ export async function publishDeterministicRuntimeConfigLease(options: {
  dataRoot: string;
  secretRoots: readonly string[];
  semanticRuntime: SemanticRuntimeConfig;
+  workspaceSecretStore?: WorkspaceSecretStore;
 }): Promise<DeterministicRuntimeConfigLease> {
  const rendered = await renderActiveWorkspaceRuntime(options);
  const publishedConfig = applyCollectionLifecycle(rendered.renderedConfig, "require_existing");
@@ -542,7 +543,7 @@ export async function publishDeterministicRuntimeConfigLease(options: {
      effectiveConfigIdentity: effectiveConfigIdentityValue,
      configFingerprint: configFingerprintValue,
      inputFingerprint: inputFingerprintValue,
-      release: () => undefined,
+      release: () => rendered.releaseSecrets(),
    };
  }

@@ -605,6 +606,6 @@ export async function publishDeterministicRuntimeConfigLease(options: {
    effectiveConfigIdentity: effectiveConfigIdentityValue,
    configFingerprint: configFingerprintValue,
    inputFingerprint: inputFingerprintValue,
-    release: () => undefined,
+    release: () => rendered.releaseSecrets(),
  };
 }