From b09f94c92f7a69d12bf350f9e76105e62e389188 Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Wed, 24 Jun 2026 13:21:33 -0700
Subject: [PATCH] test: pin security fixtures to the validation rail (EGB-283)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 test/recipients.bats | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/recipients.bats b/test/recipients.bats
index ae13b22..4c11199 100644
--- a/test/recipients.bats
+++ b/test/recipients.bats
@@ -320,6 +320,8 @@ make_second_identity() {
   run "$SECRETS_BIN" push
   [ "$status" -ne 0 ]
   [[ "$output" == *"Invalid recipient"* ]] || false
+  # The push must have aborted before encrypting — no blob should exist.
+  [ ! -e "$SECRETS_DIR/myproj/.env.age" ]
 }
 
 @test "SECURITY: control/ANSI characters in recipients.txt are rejected" {
@@ -329,6 +331,7 @@ make_second_identity() {
   create_project_dir myproj
   run "$SECRETS_BIN" push
   [ "$status" -ne 0 ]
+  [[ "$output" == *"Invalid recipient"* ]] || false
 }
 
 @test "SECURITY: recipients add rejects a key with embedded whitespace" {