Normalize runtime secret transport whitespace

src/user_engine/runtime.py

@@ -69,7 +69,13 @@ def main() -> None:
 
 
 def _required(name: str) -> str:
-    value = os.environ.get(name)
+    # Values sourced from files or `kubectl create secret --from-file` commonly
+    # retain one trailing newline.  Such a value is unusable in HTTP headers
+    # (notably USER_ENGINE_PROXY_SECRET and provisioning bearer tokens), and
+    # comparing it byte-for-byte makes the trusted boundary impossible to
+    # exercise.  Normalize transport whitespace at the runtime boundary; the
+    # domain and adapters still receive an opaque non-empty value.
+    value = os.environ.get(name, "").strip()
     if not value:
         raise RuntimeError(f"{name} is required")
     return value

tests/test_runtime_config.py

@@ -0,0 +1,20 @@
+import os
+import unittest
+from unittest.mock import patch
+
+from user_engine.runtime import _required
+
+
+class RequiredRuntimeValueTests(unittest.TestCase):
+    def test_normalizes_secret_file_newline(self):
+        with patch.dict(os.environ, {"USER_ENGINE_TEST_SECRET": "secret-value\n"}):
+            self.assertEqual(_required("USER_ENGINE_TEST_SECRET"), "secret-value")
+
+    def test_rejects_whitespace_only_value(self):
+        with patch.dict(os.environ, {"USER_ENGINE_TEST_SECRET": " \n\t"}):
+            with self.assertRaisesRegex(RuntimeError, "USER_ENGINE_TEST_SECRET is required"):
+                _required("USER_ENGINE_TEST_SECRET")
+
+
+if __name__ == "__main__":
+    unittest.main()