[PiquelChips]

Secret versions were never deleted (STORE-05). Each rotation or regeneration kept the old version's row and its Docker secret for good, so an environment that rotated a secret about 1,000 times hit SecretQuota and could only recover by deleting the secret. Old versions only need to live while something can still mount them.

The coordinator's history pass now collects them, right after the rest of history pruning:

1. Find: Store::unused_secret_versions selects generated versions and stored-secret copies that aren't their secret's current generation, that no deployment pins, and whose Docker secret no environment's running target names (prepared targets name only pinned versions). Secrets mid-deletion are left to their deletion.
2. Remove: for each environment, it removes their Docker secrets in a journaled remove_secrets action attributed to the daemon. Only once Docker confirms does it delete their records. A failure keeps them for the next pass.
3. Tidy: stored versions that aren't current and that no environment has a copy of are deleted. This includes values that were replaced before any deployment.

A version that is unused stays unused: a new deployment pins only current generations, and a restore only versions its retained deployment already pins. So restore and rollback keep working for every retained deployment.

This only has an effect once deployments are pruned, which #414 (STORE-04) adds. Until then, every version stays pinned by its deployment. The two PRs are independent and can merge in either order.

Proof: a new store test rotates a stored and a generated secret, and leaves a never-deployed stored version behind. While the first deployment exists, nothing is collected. Once it's gone, exactly its two pinned versions are reported, and after collection only the pinned and current versions remain. The secret, prune and scan tests pass (59), as does just docs. A fake-Docker test runs a full controller pass after the pinning deployment's operation is deleted. With secret removal failing, the old copy's record stays. Once removal works, the old Docker secret and its record are gone, and the new one remains.

Note

Written by Claude Opus 5.5 in Claude Code and reviewed by Claude Opus 5.5 (via T3 Code)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 12f9b77a-9a17-41cf-85fb-72082571bc3a

Commits

Reviewing files that changed from the base of the PR and between a1127cf and c683f28.

Files selected for processing: 7

• apps/piqueld/src/reconcile/coordinator.rs
• apps/piqueld/tests/fake_docker/secrets.rs
• crates/piqueld-store/src/secret/collection.rs
• crates/piqueld-store/src/secret/mod.rs
• crates/piqueld-store/src/secret/stored/tests.rs
• docs/dev/architecture/observability.md
• docs/user/applications/secrets-and-variables.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn