[acamarata]

Three technical-debt rows.

D-0708 — the credential hints now point at .env.secrets. validateNoPlaceholderSecrets says "set a unique value in the file that defines it (.env.secrets overrides .env and .env.)". The database-init failure hint in start_containers.go says the same (dbInitCredentialHints). Tests cover both. I did not change the CI-export case: build still persists a generated value when CI is set without the key. The cli repo has no deploy docs and a refusal would change build behaviour, so that part needs a docs or product decision.

D-0743 — MaskURLCredentials now also masks, in values without ://:

• Go DSN userinfo before @proto( (user:pass@tcp(...), unix(), including passwords containing @ and a key= prefix.
• A whole value of the form user:pass@host....
• password=, passwd=, pwd=, sslpassword= pairs (unquoted, quoted, or unclosed quote). Inside a URL value the unquoted run stops at & ; #, so neighbouring URL params are untouched.

Plain user@host, emails, git@host:org/repo and host:port are unchanged. Values already masked (****, [REDACTED], the reconcile NUL sentinel) are left alone. IsSecretKey now treats AUTH and *_AUTH as secret (BASIC_AUTH=user:pass, REDISCLI_AUTH). I did not add AUTH or JWT as substrings: AUTH_*, HASURA_AUTH_URL, RATE_LIMIT_AUTH_RPS, POSTGRES_HOST_AUTH_METHOD, AUTH_JWT_* must stay visible, and a test pins that. The old "schemeless value unchanged" fuzz invariant now excludes values holding @ or =. I added a linear-time test for hostile schemeless inputs.

D-1149 — .nself/compose.env now records the ENV that wrote it (# nself-build-env: <env>, a comment that compose ignores). adoptLiveCredential takes the build's ENV and adopts nothing when the marker names a different ENV, so a prod build no longer inherits a dev password. In that case the generated value is persisted as before. A compose.env without the marker (built before this change) is still adopted, so a project with a live database keeps its password; the first build after this change writes the marker. The compose.env content hashes in the plan-mode goldens changed (internal/build/testdata/plan-mode, internal/reconcile/testdata/fixtures/dev-minimal).

Verification (on this branch):

• go vet ./internal/config/ ./internal/build/ ./internal/reconcile/ ./cmd/commands/ — clean.
• go test ./internal/config/... ./internal/env/... ./internal/build/... ./cmd/... — pass.
• go test ./internal/reconcile — pass.
• New tests fail without their fixes: the hint tests look for .env.secrets, the env-marker table covers dev→prod, and the masking table covers the DSN and keyword cases.

[acamarata]

Rebased onto origin/main and fixed the go:test failure. The only failing test was the package-size ratchet (TestPackageSizeBudget). Four packages were over their ceiling: build, config and cmd/commands from this PR, and backup and cmd/commands already over on main. No ceiling was raised; code moved out instead:

• credential masking (URL and schemeless rules) moved from internal/config to the new internal/credmask. config.MaskURLCredentials is a one-line wrapper.
• the compose.env reader with the ENV marker moved to the new internal/composeenv.
• the licence-key collection moved to license.ConfiguredKeys, and the inline-option check to backup/destinations.HasInlineOption.
• credmask and composeenv are L0 rules in layers.yaml. They add no edges and no ratchet entries.
  go test ./... passes.

[acamarata]

Re-ran the gate on head 8277b5e (already rebased on origin/main d49096b, 0 behind): nself ci --check passes (go:fmt, go:vet, go:test, go:vendor-sync, go:sdk-remote-mutation), and CGO_ENABLED=0 go test -mod=vendor -count=1 ./... is clean, so the ratchet tests (nginx call sites, docker funnel, 300-line budget, panic baseline) all hold. The failure text quoted from the gate host is a zsh 'no matches found' glob on the log path, not a test failure: no log for 8277b5e exists under ~/Library/Logs/cam/ci, so the gate run likely died before go:test started. No code change made; please re-trigger nself-ci on this head.

[acamarata]

nself-ci go:test failure (mm4 log nself-cli-8277b5e): TestMountEmptyFileE125 (internal/build) and TestBuildE125UnderV15 (internal/license/entitlement) failed because they read the host's stored licence key. On mm4 that key renews a real JWT online, so the build never returned E125. They fail the same way on every other mm4 run today, including origin/main d49096b, so the PR's changes did not cause it. Fix: ef90adf isolates HOME/USERPROFILE and clears NSELF_PLUGIN_LICENSE_KEY(_OWNER) in both tests. Verified: with a real key in the env, both fail before the change and both packages pass after it. The branch was already on origin/main, so no rebase was needed. Not touched: the GitHub v1.5 leg fails TestScratchAllowlistedMarkedSiteSurvivesBuildPrune. It fails identically on main, in the D-0275 env-leak family, and is not part of this PR.