Verify Notarius credential lifecycle

internal/stage/semantic_contracts_delivery_test.go

@@ -2,6 +2,8 @@ package stage
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"testing"
 
 	configkit "gitea.maximumdirect.net/eric/ConfigKit"
@@ -93,6 +95,55 @@ func TestExtractResumeValidationExcludesOperationalSettings(t *testing.T) {
 	}
 }
 
+func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
+	const firstName = "NARRATIO_SEMANTIC_NOTARIUS_KEY"
+	const secondName = "NARRATIO_SEMANTIC_NOTARIUS_KEY_TWO"
+	first := loadNotariusCredentialForSemanticTest(t, firstName, "first-value")
+	rotated := loadNotariusCredentialForSemanticTest(t, firstName, "rotated-value")
+	renamed := loadNotariusCredentialForSemanticTest(t, secondName, "second-value")
+
+	baseline := downstreamSemanticEnv()
+	baseline.Config.Pipeline.Notarius.LLMAPIKey = first
+	want, err := (extractStage{}).SemanticConfigFingerprint(baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, test := range []struct {
+		name       string
+		credential *configkit.Secret
+	}{
+		{name: "removed", credential: nil},
+		{name: "renamed", credential: renamed},
+		{name: "value rotated", credential: rotated},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			env := downstreamSemanticEnv()
+			env.Config.Pipeline.Notarius.LLMAPIKey = test.credential
+			got, err := (extractStage{}).SemanticConfigFingerprint(env)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !want.Equal(got) {
+				t.Fatalf("credential-only change altered extract semantic fingerprint")
+			}
+		})
+	}
+}
+
+func loadNotariusCredentialForSemanticTest(t *testing.T, name, value string) *configkit.Secret {
+	t.Helper()
+	t.Setenv(name, value)
+	path := filepath.Join(t.TempDir(), "pipeline.yml")
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+name+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	pipeline, err := config.LoadPipeline(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pipeline.Notarius.LLMAPIKey
+}
+
 func TestPublishSemanticConfigSensitivityAndOperationalExclusions(t *testing.T) {
 	want, err := (publishStage{}).SemanticConfigFingerprint(downstreamSemanticEnv())
 	if err != nil {