Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_exec_delivery.py

@@ -5,6 +5,7 @@ import pytest
 from secrets_engine.catalog import validate_entry
 from secrets_engine.errors import DeliveryError
 from secrets_engine.exec_delivery import (
+    _fetch_value,
     _npm_userconfig,
     _registry_authkey,
     exec_with_secret,
@@ -70,3 +71,53 @@ def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
     )
     with pytest.raises(DeliveryError):
         exec_with_secret(object(), entry, "other_field", ["probe"], mode="exec-env")
+
+
+def test_fetch_records_non_secret_session_cleanup_before_child(monkeypatch):
+    entry = validate_entry(VALID)
+
+    class Session:
+        def __init__(self):
+            self.client = self
+            self.closed = False
+
+        def _run(self, _args):
+            from types import SimpleNamespace
+            import json
+
+            return SimpleNamespace(
+                returncode=0,
+                stdout=json.dumps({"data": {"data": {"api_token": "test-value"}}}),
+            )
+
+        def evidence(self):
+            return {
+                "session_handle": "safe-handle",
+                "established": True,
+                "revocation_attempted": self.closed,
+                "revocation_succeeded": self.closed,
+            }
+
+    session = Session()
+
+    class Client:
+        from contextlib import contextmanager
+
+        @contextmanager
+        def approle_session(self, _role):
+            try:
+                yield session
+            finally:
+                session.closed = True
+
+    evidence = {}
+    value = _fetch_value(Client(), entry, "api_token", session_evidence=evidence)
+
+    assert value == "test-value"
+    assert evidence == {
+        "session_handle": "safe-handle",
+        "established": True,
+        "revocation_attempted": True,
+        "revocation_succeeded": True,
+    }
+    assert "test-value" not in repr(evidence)