ilpanich / axiam / 29645400162

91%

push

github

fix(benchmarks): provide mandatory AMQP signing key for the AXIAM target

The release server image mandates AXIAM__AMQP__SIGNING_KEY at startup
(SECHRD-08 / D-05c) — resolve_signing_key() fails closed in a release build
when it is unset, so the bench container crashed on boot with
ServiceUnavailable('AMQP signing key not configured'). bench-up now
generates a stable hex key under docker/.secrets/ (alongside the JWT
keypair) and exports it, and the target compose wires it in fail-closed.

This is the only remaining startup-fatal secret: the MFA/PKI/federation/
email encryption keys are optional (load_key_from_env returns None and the
subsystems degrade gracefully when absent) and are not exercised by the
benchmark's login/oauth2/authz scenarios or seeding (oauth2 client secrets
are hashed, not encrypted), so they are intentionally left unset.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NEQ27rSiTYmitP6MaVnBTp

1682 of 1859 branches covered (90.48%)

Branch coverage included in aggregate %.

27336 of 33350 relevant lines covered (81.97%)

71.06 hits per line