FN-8825: move secrets fingerprints into private Git metadata
Store secrets environment fingerprint metadata in private Git directories so refresh-enabled worktrees remain clean.
- Reconcile and durably migrate legacy root fingerprint sidecars before strict worktree refreshes.
- Fail closed for malformed, tracked, conflicting, or non-durable fingerprint records and protect cleanup integrity.
- Add coverage and document the private fingerprint record contract.
Files changed: .changeset/fn-8825-secrets-env-fingerprint.md | 7 +
docs/secrets.md | 5 +-
.../secrets-env-materialization.test.ts | 45 ++-
.../src/__tests__/secrets-env-writer.test.ts | 325 ++++++++++++++-
.../worktree-acquisition-secrets-env.test.ts | 61 ++-
packages/engine/src/worktree/secrets-env-writer.ts | 434 ++++++++++++++++-----
.../engine/src/worktree/worktree-acquisition.ts | 22 +-
7 files changed, 799 insertions(+), 100 deletions(-)
Fusion-Task-Id: FN-8825
Fusion-Task-Lineage: eb7148bd-1da7-4448-8abf-498ddaebd4c0
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
e78c09c6f4