Pre-landing review (1 critical, 4 informational):
- CRITICAL: per-project `secrets verify` during the migration window flagged
the freshly-written v2 twin as a spurious orphan and exited 1 (store still
reads v1, so verify's expected set only held the .gradle-properties.age name).
Breaks the documented migrate->verify->finalize workflow and CI. Fix: verify's
orphan set now accounts for BOTH suffix forms of a properties external, so the
twin is never a false orphan mid-migration. Regression test added.
- Copy-forward now pushes the twins (mirrors push/rekey) so a --finalize on
another machine sees them; previously twins were local-only until finalize,
a multi-machine footgun.
- Dropped the undocumented `--force` alias (keep `--yes`).
- Clarified the EGB-700 comment (which-format line, folded into EGB-703).
Deferred to EGB-701: the two finalize find-walks over *.gradle-properties.age
could collapse to one pass. Full suite 236/236.
Coverage audit found 4 untested branches (all single-test fills): finalize on
a v1 dotenv/file-only store (v1count==0 stamp path — a real user scenario),
the migrate positional-arg die, finalize on an already-v2 store, and the
_store_format strict-parse defense (garbage marker reads as v1). Full suite 235/235.
Stage 2 of EGB-677. Makes the store self-describing and unifies the legacy
external `properties` blob suffix, via a copy-forward migration that never
destroys data until an explicit, gated finalize.
Scope decision (see eureka): the EGB-677 CEO plan's "flatten dotenv blobs to
basename" was dropped as LOSSY — it discards the restore relpath that makes
the store self-describing and adds basename collisions. Engineering analysis
(4 parallel design agents) showed the store is already relpath-self-describing;
the only real v1→v2 delta is the `properties` suffix. This implements the
minimal, safe v2 that achieves the epic's self-describing goal.
What's added:
- `.secrets-format` marker (committed, one line `2`). Absence ⇒ v1 (every
pre-EGB-703 store). `_store_format()` reads it; `init` stamps fresh stores
born-v2. `secrets which` prints `format: vN` (EGB-700 folded in).
- `_external_blob_suffix(type)` — single source of truth for the external
suffix (v2: gradle-properties → properties; file unchanged). push/pull/verify
all route through it, so v1 and v2 stores never disagree on blob location.
- `secrets migrate` — per-project copy-forward (writes `.properties.age` twins
beside v1 blobs; idempotent; needs the project manifest), `--dry-run`
(reports old→new, writes nothing), `--finalize` (store-wide, the only
destructive step: gates on `verify --all` green + every v1 blob twinned,
cuts a `pre-v2-migrate-<sha>` recovery tag, stamps the marker, then drops v1
blobs; refuses without `--yes`/operator confirmation).
rekey and verify --all stay format-agnostic (recursive find walk) — no change.
21 new bats tests (test/migrate.bats): marker/born-v2, format-aware suffix,
v1 back-compat, dry-run, copy-forward idempotency, no-manifest die, finalize
gates (verify-not-green refusal, untwinned refusal, recovery tag, confirmation),
and full v1→window→finalize round-trip. Updated 4 existing tests for the
born-v2 suffix. Full suite 231/231, bash 3.2 clean.
