Chapter 24 — worked answers

1. Metadata and execution are different interfaces

Secret GET/list return SecretMetadata, not plaintext. resolveEnvLocked decrypts a namespace-scoped reference and puts it in the assigned task Env, which the authorized agent needs to create a container. Protecting the metadata interface does not imply the agent/Docker administrator cannot inspect execution values.

2. Integrity and custody have separate owners

Each Encrypt call gets a random GCM nonce, prepends it and authenticates KeyID as associated data. Decrypt checks expected key identity and GCM authentication. The wrong-key fixture proves rejection in that implementation; it does not prove secure key storage, external KMS, rotation or default process durability.

3. Explicit override wins

Loader order yields key C, assuming all values meet helper/validation rules. Redacted prints the sentinel for a nonempty secret, intentionally concealing which concrete value won. Use an in-memory fixture assertion for precedence and keep public evidence to configuration-source and pass/fail outcomes.

4. Observe three objects separately

Record encrypted record metadata/key identity, a boolean assigned-task canary check and container identity/start time. Updating stored secret can change future resolution without editing an existing container environment. A new envelope key can reject old ciphertext; a rotation extension needs re-encryption and old-key retirement evidence. Never dump real plaintext to prove either boundary.

Return to Chapter 24.