From 2463d81e1990e71552472c6f29aa610557928145 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sat, 12 Sep 2026 12:18:41 -0600
Subject: [PATCH 01/13] fix(secrets): persist concrete backend ownership

---
 cmd/secrets/list.go                           |   4 +-
 desktop/src/main/ipc.ts                       |   1 +
 .../src/renderer/src/lib/stores/secrets.ts    |  11 +-
 desktop/src/renderer/src/lib/types/index.ts   |   1 +
 .../src/renderer/src/pages/SecretsPage.svelte |  10 +-
 pkg/secrets/backend_registry.go               | 112 +++++++++++++
 pkg/secrets/index.go                          |  20 +++
 pkg/secrets/local_store.go                    | 147 +++++++++---------
 pkg/secrets/store.go                          |   1 +
 pkg/secrets/store_internal_test.go            |  35 +----
 .../docs/developing-in-workspaces/secrets.mdx |  12 +-
 11 files changed, 241 insertions(+), 113 deletions(-)
 create mode 100644 pkg/secrets/backend_registry.go

diff --git a/cmd/secrets/list.go b/cmd/secrets/list.go
index 90ba14014..0d4bb7196 100644
--- a/cmd/secrets/list.go
+++ b/cmd/secrets/list.go
@@ -37,6 +37,7 @@ func NewListCmd(flags *flags.GlobalFlags) *cobra.Command {
 type secretEntry struct {
 	Name     string `json:"name"`
 	Context  string `json:"context"`
+	Backend  string `json:"backend,omitempty"`
 	Created  string `json:"created,omitempty"`
 	LastUsed string `json:"lastUsed,omitempty"`
 	Orphaned bool   `json:"orphaned,omitempty"`
@@ -93,6 +94,7 @@ func renderJSON(metas []secrets.SecretMeta) error {
 		entries = append(entries, secretEntry{
 			Name:     m.Name,
 			Context:  m.Context,
+			Backend:  string(m.Backend),
 			Created:  formatTime(m.Created),
 			LastUsed: formatTime(m.LastUsed),
 			Orphaned: m.Orphaned,
@@ -117,7 +119,7 @@ func formatTime(t time.Time) string {
 
 func orphanLabel(orphaned bool) string {
 	if orphaned {
-		return "orphaned"
+		return "missing value"
 	}
 	return "ok"
 }
diff --git a/desktop/src/main/ipc.ts b/desktop/src/main/ipc.ts
index 3cd27d01a..5a6cd3a8a 100644
--- a/desktop/src/main/ipc.ts
+++ b/desktop/src/main/ipc.ts
@@ -42,6 +42,7 @@ interface SecretEntry {
   created?: string
   lastUsed?: string
   orphaned?: boolean
+  backend?: "keyring" | "file"
 }
 
 interface EnvEntry {
diff --git a/desktop/src/renderer/src/lib/stores/secrets.ts b/desktop/src/renderer/src/lib/stores/secrets.ts
index 14b5333d1..2b98afcbe 100644
--- a/desktop/src/renderer/src/lib/stores/secrets.ts
+++ b/desktop/src/renderer/src/lib/stores/secrets.ts
@@ -4,12 +4,14 @@ import type { Secret } from "$lib/types/index.js"
 
 export const secrets = writable<Secret[]>([])
 export const secretsLoading = writable(true)
+export const secretsError = writable<string | null>(null)
 
 export async function refreshSecrets(): Promise<void> {
   try {
     secrets.set(await secretList())
-  } catch {
-    // IPC not available
+    secretsError.set(null)
+  } catch (err) {
+    secretsError.set(err instanceof Error ? err.message : String(err))
   }
 }
 
@@ -17,8 +19,9 @@ export async function initSecrets(): Promise<void> {
   secretsLoading.set(true)
   try {
     secrets.set(await secretList())
-  } catch {
-    // IPC not available
+    secretsError.set(null)
+  } catch (err) {
+    secretsError.set(err instanceof Error ? err.message : String(err))
   } finally {
     secretsLoading.set(false)
   }
diff --git a/desktop/src/renderer/src/lib/types/index.ts b/desktop/src/renderer/src/lib/types/index.ts
index 45f7a17a3..10c2b6f9b 100644
--- a/desktop/src/renderer/src/lib/types/index.ts
+++ b/desktop/src/renderer/src/lib/types/index.ts
@@ -151,6 +151,7 @@ export interface Secret {
   created?: string
   lastUsed?: string
   orphaned?: boolean
+  backend?: "keyring" | "file"
 }
 
 export interface EnvVar {
diff --git a/desktop/src/renderer/src/pages/SecretsPage.svelte b/desktop/src/renderer/src/pages/SecretsPage.svelte
index 19ce8eb75..75f4f0e6d 100644
--- a/desktop/src/renderer/src/pages/SecretsPage.svelte
+++ b/desktop/src/renderer/src/pages/SecretsPage.svelte
@@ -7,7 +7,7 @@ import { badgeVariants } from "$lib/components/ui/badge/index.js"
 import * as Dialog from "$lib/components/ui/dialog/index.js"
 import ConfirmDialog from "$lib/components/layout/ConfirmDialog.svelte"
 import CardSkeleton from "$lib/components/ui/skeleton/CardSkeleton.svelte"
-import { secrets, secretsLoading, refreshSecrets } from "$lib/stores/secrets.js"
+import { secrets, secretsError, secretsLoading, refreshSecrets } from "$lib/stores/secrets.js"
 import { secretSet, secretDelete } from "$lib/ipc/commands.js"
 import { toasts } from "$lib/stores/toasts.js"
 import { extractErrorMessage } from "$lib/utils/error.js"
@@ -102,7 +102,7 @@ async function confirmDelete() {
         <Dialog.Header>
           <Dialog.Title>{nameExists ? "Replace Secret" : "Add Secret"}</Dialog.Title>
           <Dialog.Description>
-            Stored in your OS keyring and injected into workspaces on demand.
+            Stored securely in your configured Devsy secrets backend and injected into workspaces on demand.
           </Dialog.Description>
         </Dialog.Header>
         <form onsubmit={(e) => { e.preventDefault(); handleCreate() }} class="space-y-4">
@@ -158,6 +158,10 @@ async function confirmDelete() {
         <CardSkeleton />
       {/each}
     </div>
+  {:else if $secretsError}
+    <div class="rounded-xl border border-destructive/50 bg-destructive/10 p-4 text-sm text-destructive">
+      Unable to load secrets: {$secretsError}
+    </div>
   {:else if $secrets.length === 0}
     <div class="flex flex-col items-center justify-center gap-4 py-16 text-center">
       <KeyRound class="h-10 w-10 text-muted-foreground" />
@@ -189,7 +193,7 @@ async function confirmDelete() {
               </div>
               <div class="flex items-center gap-1.5 shrink-0">
                 {#if secret.orphaned}
-                  <span class={badgeVariants({ variant: "destructive" })}>orphaned</span>
+                  <span class={badgeVariants({ variant: "destructive" })} title={`Devsy has metadata for this secret, but its value is missing from the ${secret.backend ?? "configured"} backend.`}>Missing value</span>
                 {/if}
                 <Button variant="ghost" size="icon" aria-label="Delete secret" onclick={(e) => requestDelete(e, secret.name)}>
                   <Trash2 class="h-4 w-4" />
diff --git a/pkg/secrets/backend_registry.go b/pkg/secrets/backend_registry.go
new file mode 100644
index 000000000..c12cf0a35
--- /dev/null
+++ b/pkg/secrets/backend_registry.go
@@ -0,0 +1,112 @@
+package secrets
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"filippo.io/age"
+)
+
+type backendRegistry interface {
+	Open(kind Backend, idx *index, create bool) (backend, error)
+	ResolveForNewSecret(preference Backend, idx *index) (Backend, error)
+}
+
+type fixedBackendRegistry struct{ b backend }
+
+func (r fixedBackendRegistry) Open(_ Backend, _ *index, _ bool) (backend, error) { return r.b, nil }
+func (r fixedBackendRegistry) ResolveForNewSecret(_ Backend, _ *index) (Backend, error) {
+	return BackendKeyring, nil
+}
+
+type systemBackendRegistry struct{ dir string }
+
+func newSystemBackendRegistry(dir string) backendRegistry { return &systemBackendRegistry{dir: dir} }
+
+func (r *systemBackendRegistry) Open(kind Backend, idx *index, create bool) (backend, error) {
+	switch kind {
+	case BackendKeyring:
+		return keyringBackend{}, nil
+	case BackendFile:
+		var key *fileKey
+		var err error
+		if create {
+			key, err = resolveFileKey(r.dir, os.Getenv(EnvPassphrase))
+		} else {
+			key, err = openExistingFileKey(r.dir, idx)
+		}
+		if err != nil {
+			return nil, err
+		}
+		if create && idx != nil {
+			idx.data.KeySource = string(key.source)
+		}
+		return newFileBackend(filepath.Join(r.dir, EncryptedFileName), key), nil
+	default:
+		return nil, fmt.Errorf("invalid secrets backend %q", kind)
+	}
+}
+
+func (r *systemBackendRegistry) ResolveForNewSecret(preference Backend, idx *index) (Backend, error) {
+	switch preference {
+	case BackendKeyring:
+		return BackendKeyring, nil
+	case BackendFile:
+		return BackendFile, nil
+	case BackendAuto:
+		if keyringAvailable() {
+			return BackendKeyring, nil
+		}
+		return BackendFile, nil
+	default:
+		return "", fmt.Errorf("invalid secrets backend %q", preference)
+	}
+}
+
+func openExistingFileKey(dir string, idx *index) (*fileKey, error) {
+	source := keySource(idx.data.KeySource)
+	if source == "" {
+		return nil, fmt.Errorf("encrypted secrets are missing their key source metadata")
+	}
+	if source == keySourcePassphrase {
+		passphrase := os.Getenv(EnvPassphrase)
+		if passphrase == "" {
+			return nil, fmt.Errorf("encrypted secrets require %s", EnvPassphrase)
+		}
+		recipient, err := age.NewScryptRecipient(passphrase)
+		if err != nil {
+			return nil, err
+		}
+		identity, err := age.NewScryptIdentity(passphrase)
+		if err != nil {
+			return nil, err
+		}
+		return &fileKey{recipient: recipient, identity: identity, source: source}, nil
+	}
+	var store keyStore
+	if source == keySourceKeyring {
+		store = keyringKeyStore{}
+	} else if source == keySourceAutoFile {
+		store = fileKeyStore{path: filepath.Join(dir, KeyFileName)}
+	} else {
+		return nil, fmt.Errorf("invalid secrets key source %q", source)
+	}
+	return keyFromStore(store, source)
+}
+
+func keyFromStore(store keyStore, source keySource) (*fileKey, error) {
+	encoded, err := store.load()
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(encoded) == "" {
+		return nil, ErrSecretNotFound
+	}
+	identity, err := age.ParseX25519Identity(strings.TrimSpace(encoded))
+	if err != nil {
+		return nil, fmt.Errorf("parse stored secrets key: %w", err)
+	}
+	return &fileKey{recipient: identity.Recipient(), identity: identity, source: source}, nil
+}
diff --git a/pkg/secrets/index.go b/pkg/secrets/index.go
index a95d2e26e..dc4b19a45 100644
--- a/pkg/secrets/index.go
+++ b/pkg/secrets/index.go
@@ -40,6 +40,9 @@ func loadIndex(path string) (*index, error) {
 		idx.data.Contexts = map[string]map[string]SecretMeta{}
 	}
 	idx.normalizeKinds()
+	if err := idx.validateBackends(); err != nil {
+		return nil, err
+	}
 
 	return idx, nil
 }
@@ -58,6 +61,23 @@ func (i *index) normalizeKinds() {
 	}
 }
 
+func (i *index) validateBackends() error {
+	for context, entries := range i.data.Contexts {
+		for name, meta := range entries {
+			if meta.Kind == KindEnv {
+				if meta.Backend != "" {
+					return fmt.Errorf("invalid backend %q for environment entry %s/%s", meta.Backend, context, name)
+				}
+				continue
+			}
+			if meta.Backend != "" && meta.Backend != BackendKeyring && meta.Backend != BackendFile {
+				return fmt.Errorf("invalid secrets backend %q for %s/%s", meta.Backend, context, name)
+			}
+		}
+	}
+	return nil
+}
+
 func (i *index) save() error {
 	out, err := yaml.Marshal(i.data)
 	if err != nil {
diff --git a/pkg/secrets/local_store.go b/pkg/secrets/local_store.go
index 9ce3597c8..c037cf2c1 100644
--- a/pkg/secrets/local_store.go
+++ b/pkg/secrets/local_store.go
@@ -27,12 +27,12 @@ const (
 )
 
 type localStore struct {
-	backend   backend
-	indexPath string
-	now       func() time.Time
-
-	// keySource is empty for the keyring backend; checked against the index so a
-	// key-source change is a clear error rather than a decryption failure.
+	preference Backend
+	backends   backendRegistry
+	indexPath  string
+	now        func() time.Time
+	// Retained for compatibility with the file-backed test seam. System stores
+	// validate the source when opening the concrete file backend.
 	keySource keySource
 }
 
@@ -44,18 +44,8 @@ func NewStoreForConfig(devsyConfig *config.Config) (Store, error) {
 	dir := filepath.Dir(configPath)
 	indexPath := filepath.Join(dir, IndexFileName)
 
-	switch resolveBackend(devsyConfig) {
-	case BackendKeyring:
-		return newLocalStore(keyringBackend{}, indexPath), nil
-	case BackendFile:
-		return newFileStore(dir, indexPath)
-	default:
-		if keyringAvailable() {
-			return newLocalStore(keyringBackend{}, indexPath), nil
-		}
-
-		return newFileStore(dir, indexPath)
-	}
+	return newLocalStoreWithRegistry(resolveBackend(devsyConfig), indexPath,
+		newSystemBackendRegistry(dir)), nil
 }
 
 func resolveBackend(devsyConfig *config.Config) Backend {
@@ -81,21 +71,12 @@ func normalizeBackend(value string) Backend {
 	}
 }
 
-func newFileStore(dir, indexPath string) (Store, error) {
-	key, err := resolveFileKey(dir, os.Getenv(EnvPassphrase))
-	if err != nil {
-		return nil, err
-	}
-
-	fb := newFileBackend(filepath.Join(dir, EncryptedFileName), key)
-	s := newLocalStore(fb, indexPath)
-	s.keySource = key.source
-
-	return s, nil
+func newLocalStore(b backend, indexPath string) *localStore {
+	return newLocalStoreWithRegistry(BackendKeyring, indexPath, fixedBackendRegistry{b: b})
 }
 
-func newLocalStore(b backend, indexPath string) *localStore {
-	return &localStore{backend: b, indexPath: indexPath, now: time.Now}
+func newLocalStoreWithRegistry(preference Backend, indexPath string, backends backendRegistry) *localStore {
+	return &localStore{preference: preference, backends: backends, indexPath: indexPath, now: time.Now}
 }
 
 func (s *localStore) Set(context, name, value string, kind Kind) error {
@@ -119,6 +100,9 @@ func (s *localStore) Set(context, name, value string, kind Kind) error {
 		meta = SecretMeta{Name: name, Context: context, Created: s.now().UTC()}
 	}
 	wasSensitive := exists && meta.Sensitive()
+	if wasSensitive && meta.Backend == "" {
+		return fmt.Errorf("secret %q is missing persisted backend ownership", name)
+	}
 	meta.Kind = kind
 	meta.Value = value
 
@@ -126,7 +110,12 @@ func (s *localStore) Set(context, name, value string, kind Kind) error {
 		return err
 	}
 	if meta.Sensitive() {
+		if err := s.checkKeySource(idx); err != nil {
+			return err
+		}
 		meta.Value = ""
+	} else {
+		meta.Backend = ""
 	}
 
 	idx.put(meta)
@@ -153,7 +142,14 @@ func (s *localStore) Get(context, name string) (string, error) {
 		if err := s.checkKeySource(idx); err != nil {
 			return "", err
 		}
-		if value, err = s.backend.get(backendKey(context, name)); err != nil {
+		if meta.Backend == "" {
+			return "", fmt.Errorf("secret %q is missing persisted backend ownership", name)
+		}
+		b, err := s.backends.Open(meta.Backend, idx, false)
+		if err != nil {
+			return "", err
+		}
+		if value, err = b.get(backendKey(context, name)); err != nil {
 			return "", err
 		}
 	} else {
@@ -182,11 +178,17 @@ func (s *localStore) Delete(context, name string) error {
 	}
 
 	if meta, ok := idx.get(context, name); ok && meta.Sensitive() {
-		if err := s.checkKeySource(idx); err != nil {
-			return err
+		if meta.Backend == "" {
+			return fmt.Errorf("secret %q is missing persisted backend ownership", name)
 		}
-		if err := s.backend.remove(backendKey(context, name)); err != nil {
-			return err
+		if meta.Backend != "" {
+			b, openErr := s.backends.Open(meta.Backend, idx, false)
+			if openErr != nil {
+				return openErr
+			}
+			if err := b.remove(backendKey(context, name)); err != nil {
+				return err
+			}
 		}
 	}
 	idx.remove(context, name)
@@ -208,8 +210,8 @@ func (s *localStore) Meta(context, name string) (SecretMeta, error) {
 	return meta, nil
 }
 
-// List returns the context's entries, flagging any sensitive entry whose backend
-// value is missing (orphaned).
+// List returns the context's entries, flagging sensitive entries whose owned
+// backend value is missing.
 func (s *localStore) List(context string) ([]SecretMeta, error) {
 	idx, err := loadIndex(s.indexPath)
 	if err != nil {
@@ -220,19 +222,24 @@ func (s *localStore) List(context string) ([]SecretMeta, error) {
 	if !anySensitive(entries) {
 		return entries, nil
 	}
-	if err := s.checkKeySource(idx); err != nil {
-		return nil, err
-	}
-
 	for i := range entries {
 		if !entries[i].Sensitive() {
 			continue
 		}
-		orphaned, err := s.isOrphaned(context, entries[i].Name)
+		meta := entries[i]
+		if meta.Backend == "" {
+			return nil, fmt.Errorf("secret %q is missing persisted backend ownership", meta.Name)
+		}
+		b, err := s.backends.Open(meta.Backend, idx, false)
 		if err != nil {
 			return nil, err
 		}
-		entries[i].Orphaned = orphaned
+		_, err = b.get(backendKey(context, entries[i].Name))
+		if errors.Is(err, ErrSecretNotFound) {
+			entries[i].Orphaned = true
+		} else if err != nil {
+			return nil, err
+		}
 	}
 
 	return entries, nil
@@ -273,29 +280,22 @@ func anySensitive(entries []SecretMeta) bool {
 	return false
 }
 
-func (s *localStore) isOrphaned(context, name string) (bool, error) {
-	_, err := s.backend.get(backendKey(context, name))
-	switch {
-	case err == nil:
-		return false, nil
-	case errors.Is(err, ErrSecretNotFound):
-		return true, nil
-	default:
-		return false, fmt.Errorf("reconcile secret %q: %w", name, err)
-	}
-}
-
 func (s *localStore) persistValue(
 	idx *index, meta *SecretMeta, value string, wasSensitive bool,
 ) error {
-	key := backendKey(meta.Context, meta.Name)
-	if meta.Sensitive() || wasSensitive {
-		if err := s.checkKeySource(idx); err != nil {
+	if meta.Sensitive() {
+		if meta.Backend == "" {
+			resolved, err := s.backends.ResolveForNewSecret(s.preference, idx)
+			if err != nil {
+				return err
+			}
+			meta.Backend = resolved
+		}
+		b, err := s.backends.Open(meta.Backend, idx, true)
+		if err != nil {
 			return err
 		}
-	}
-	if meta.Sensitive() {
-		if err := s.backend.set(key, value); err != nil {
+		if err := b.set(backendKey(meta.Context, meta.Name), value); err != nil {
 			return err
 		}
 		if s.keySource != "" {
@@ -304,24 +304,21 @@ func (s *localStore) persistValue(
 		return nil
 	}
 	if wasSensitive {
-		return s.backend.remove(key)
+		if err := s.checkKeySource(idx); err != nil {
+			return err
+		}
+		b, err := s.backends.Open(meta.Backend, idx, false)
+		if err != nil {
+			return err
+		}
+		return b.remove(backendKey(meta.Context, meta.Name))
 	}
 	return nil
 }
 
-// checkKeySource rejects a key-source change with a clear error instead of a
-// downstream decryption failure.
 func (s *localStore) checkKeySource(idx *index) error {
-	if s.keySource == "" || idx.data.KeySource == "" {
+	if s.keySource == "" || idx.data.KeySource == "" || idx.data.KeySource == string(s.keySource) {
 		return nil
 	}
-	if idx.data.KeySource != string(s.keySource) {
-		return fmt.Errorf(
-			"secrets were encrypted with the %q key source but the current source is %q; "+
-				"restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets",
-			idx.data.KeySource, s.keySource,
-		)
-	}
-
-	return nil
+	return fmt.Errorf("secrets were encrypted with the %q key source but the current source is %q; restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets", idx.data.KeySource, s.keySource)
 }
diff --git a/pkg/secrets/store.go b/pkg/secrets/store.go
index 830b66e3e..8c8527153 100644
--- a/pkg/secrets/store.go
+++ b/pkg/secrets/store.go
@@ -43,6 +43,7 @@ type SecretMeta struct {
 	Value    string    `json:"value,omitempty"`
 	Created  time.Time `json:"created"`
 	LastUsed time.Time `json:"lastUsed,omitzero"`
+	Backend  Backend   `json:"backend,omitempty"`
 
 	Orphaned bool `json:"-"`
 }
diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index 355af1a66..ac99ca170 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -349,32 +349,20 @@ func TestFileBackend_AutoKeyRoundTrip(t *testing.T) {
 	}
 }
 
-// An index entry with an unset Kind (e.g. written by an older layout) must be
-// read as a secret, never silently downgraded to a plaintext env var.
-func TestLoadIndex_UnsetKindNormalizesToSecret(t *testing.T) {
+func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
 	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n      context: default\n"
 	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
-	idx, err := loadIndex(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	meta, ok := idx.get("default", "LEGACY")
-	if !ok {
-		t.Fatal("expected entry to load")
-	}
-	if !meta.Sensitive() {
-		t.Fatalf("unset Kind must normalize to secret, got %q", meta.Kind)
+	s := newLocalStore(newMapBackend(), path)
+	if _, err := s.Get(testContext, "LEGACY"); err == nil || !strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
 
-// A blank-kind entry carrying an inline value (e.g. hand-edited) must be
-// normalized to a secret with the inline plaintext cleared, upholding the
-// invariant that sensitive values never persist inline.
-func TestLoadIndex_UnsetKindClearsInlineValue(t *testing.T) {
+func TestStore_RejectsLegacyInlineSecret(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
 	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n" +
 		"      context: default\n      value: leaked\n"
@@ -382,16 +370,9 @@ func TestLoadIndex_UnsetKindClearsInlineValue(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	idx, err := loadIndex(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	meta, _ := idx.get("default", "LEGACY")
-	if !meta.Sensitive() {
-		t.Fatalf("unset Kind must normalize to secret, got %q", meta.Kind)
-	}
-	if meta.Value != "" {
-		t.Fatalf("inline value must be cleared on normalize, got %q", meta.Value)
+	s := newLocalStore(newMapBackend(), path)
+	if _, err := s.Get(testContext, "LEGACY"); err == nil || !strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
 
diff --git a/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx b/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
index 8b6b83e00..3c8badc30 100644
--- a/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
+++ b/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
@@ -55,8 +55,9 @@ devsy secret get DB_PASSWORD
 devsy secret delete DB_PASSWORD
 ```
 
-`devsy secret list` never prints values. A value removed from the OS keyring
-outside Devsy is shown as `orphaned`.
+`devsy secret list` never prints values. A value missing from its recorded
+backend is shown as `Missing value`. Backend access failures, such as a locked
+keychain or decryption failure, are reported as errors instead.
 
 ## External Secret Sources
 
@@ -300,7 +301,8 @@ For Devsy-managed values, use the supported backends:
 - `keyring` — the OS keyring (Keychain / Credential Manager / libsecret).
 - `file` — an [age](https://age-encryption.org)-encrypted `secrets.enc` stored
   alongside the Devsy config.
-- `auto` — use the keyring when available and otherwise fall back to `file`.
+- `auto` — choose the keyring when available and otherwise fall back to `file`
+  for new secrets.
 
 Set a persistent preference per context with:
 
@@ -310,6 +312,10 @@ devsy context set -o SECRETS_BACKEND=file
 
 Or override it for one command with `DEVSY_SECRETS_BACKEND`.
 
+These settings select storage only when a new Devsy-managed secret is created.
+After creation, the concrete backend is recorded in `secrets.yaml` and the
+secret stays there even if the preference changes.
+
 The local `file` backend generates and manages an encryption key automatically.
 For stronger at-rest protection, set a passphrase with
 `DEVSY_SECRETS_PASSPHRASE`; the derived encryption key is then not stored on

From 2f8e955678f14dc51a5ed749fe24a0d34d3ff10b Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sat, 12 Sep 2026 12:30:04 -0600
Subject: [PATCH 02/13] fix(secrets): satisfy lint checks

---
 pkg/secrets/backend_registry.go    | 48 +++++++++++--------
 pkg/secrets/index.go               | 14 +++++-
 pkg/secrets/local_store.go         | 74 +++++++++++++++++++-----------
 pkg/secrets/store_internal_test.go | 12 ++++-
 4 files changed, 100 insertions(+), 48 deletions(-)

diff --git a/pkg/secrets/backend_registry.go b/pkg/secrets/backend_registry.go
index c12cf0a35..cb936a181 100644
--- a/pkg/secrets/backend_registry.go
+++ b/pkg/secrets/backend_registry.go
@@ -23,7 +23,11 @@ func (r fixedBackendRegistry) ResolveForNewSecret(_ Backend, _ *index) (Backend,
 
 type systemBackendRegistry struct{ dir string }
 
-func newSystemBackendRegistry(dir string) backendRegistry { return &systemBackendRegistry{dir: dir} }
+func newSystemBackendRegistry(
+	dir string,
+) backendRegistry {
+	return &systemBackendRegistry{dir: dir}
+}
 
 func (r *systemBackendRegistry) Open(kind Backend, idx *index, create bool) (backend, error) {
 	switch kind {
@@ -49,7 +53,10 @@ func (r *systemBackendRegistry) Open(kind Backend, idx *index, create bool) (bac
 	}
 }
 
-func (r *systemBackendRegistry) ResolveForNewSecret(preference Backend, idx *index) (Backend, error) {
+func (r *systemBackendRegistry) ResolveForNewSecret(
+	preference Backend,
+	idx *index,
+) (Backend, error) {
 	switch preference {
 	case BackendKeyring:
 		return BackendKeyring, nil
@@ -71,31 +78,36 @@ func openExistingFileKey(dir string, idx *index) (*fileKey, error) {
 		return nil, fmt.Errorf("encrypted secrets are missing their key source metadata")
 	}
 	if source == keySourcePassphrase {
-		passphrase := os.Getenv(EnvPassphrase)
-		if passphrase == "" {
-			return nil, fmt.Errorf("encrypted secrets require %s", EnvPassphrase)
-		}
-		recipient, err := age.NewScryptRecipient(passphrase)
-		if err != nil {
-			return nil, err
-		}
-		identity, err := age.NewScryptIdentity(passphrase)
-		if err != nil {
-			return nil, err
-		}
-		return &fileKey{recipient: recipient, identity: identity, source: source}, nil
+		return openPassphraseFileKey()
 	}
 	var store keyStore
-	if source == keySourceKeyring {
+	switch source {
+	case keySourceKeyring:
 		store = keyringKeyStore{}
-	} else if source == keySourceAutoFile {
+	case keySourceAutoFile:
 		store = fileKeyStore{path: filepath.Join(dir, KeyFileName)}
-	} else {
+	default:
 		return nil, fmt.Errorf("invalid secrets key source %q", source)
 	}
 	return keyFromStore(store, source)
 }
 
+func openPassphraseFileKey() (*fileKey, error) {
+	passphrase := os.Getenv(EnvPassphrase)
+	if passphrase == "" {
+		return nil, fmt.Errorf("encrypted secrets require %s", EnvPassphrase)
+	}
+	recipient, err := age.NewScryptRecipient(passphrase)
+	if err != nil {
+		return nil, err
+	}
+	identity, err := age.NewScryptIdentity(passphrase)
+	if err != nil {
+		return nil, err
+	}
+	return &fileKey{recipient: recipient, identity: identity, source: keySourcePassphrase}, nil
+}
+
 func keyFromStore(store keyStore, source keySource) (*fileKey, error) {
 	encoded, err := store.load()
 	if err != nil {
diff --git a/pkg/secrets/index.go b/pkg/secrets/index.go
index dc4b19a45..866be9bba 100644
--- a/pkg/secrets/index.go
+++ b/pkg/secrets/index.go
@@ -66,12 +66,22 @@ func (i *index) validateBackends() error {
 		for name, meta := range entries {
 			if meta.Kind == KindEnv {
 				if meta.Backend != "" {
-					return fmt.Errorf("invalid backend %q for environment entry %s/%s", meta.Backend, context, name)
+					return fmt.Errorf(
+						"invalid backend %q for environment entry %s/%s",
+						meta.Backend,
+						context,
+						name,
+					)
 				}
 				continue
 			}
 			if meta.Backend != "" && meta.Backend != BackendKeyring && meta.Backend != BackendFile {
-				return fmt.Errorf("invalid secrets backend %q for %s/%s", meta.Backend, context, name)
+				return fmt.Errorf(
+					"invalid secrets backend %q for %s/%s",
+					meta.Backend,
+					context,
+					name,
+				)
 			}
 		}
 	}
diff --git a/pkg/secrets/local_store.go b/pkg/secrets/local_store.go
index c037cf2c1..156f79105 100644
--- a/pkg/secrets/local_store.go
+++ b/pkg/secrets/local_store.go
@@ -75,8 +75,17 @@ func newLocalStore(b backend, indexPath string) *localStore {
 	return newLocalStoreWithRegistry(BackendKeyring, indexPath, fixedBackendRegistry{b: b})
 }
 
-func newLocalStoreWithRegistry(preference Backend, indexPath string, backends backendRegistry) *localStore {
-	return &localStore{preference: preference, backends: backends, indexPath: indexPath, now: time.Now}
+func newLocalStoreWithRegistry(
+	preference Backend,
+	indexPath string,
+	backends backendRegistry,
+) *localStore {
+	return &localStore{
+		preference: preference,
+		backends:   backends,
+		indexPath:  indexPath,
+		now:        time.Now,
+	}
 }
 
 func (s *localStore) Set(context, name, value string, kind Kind) error {
@@ -284,41 +293,54 @@ func (s *localStore) persistValue(
 	idx *index, meta *SecretMeta, value string, wasSensitive bool,
 ) error {
 	if meta.Sensitive() {
-		if meta.Backend == "" {
-			resolved, err := s.backends.ResolveForNewSecret(s.preference, idx)
-			if err != nil {
-				return err
-			}
-			meta.Backend = resolved
-		}
-		b, err := s.backends.Open(meta.Backend, idx, true)
-		if err != nil {
-			return err
-		}
-		if err := b.set(backendKey(meta.Context, meta.Name), value); err != nil {
-			return err
-		}
-		if s.keySource != "" {
-			idx.data.KeySource = string(s.keySource)
-		}
-		return nil
+		return s.persistSensitive(idx, meta, value)
 	}
 	if wasSensitive {
-		if err := s.checkKeySource(idx); err != nil {
-			return err
-		}
-		b, err := s.backends.Open(meta.Backend, idx, false)
+		return s.removeSensitive(idx, meta)
+	}
+	return nil
+}
+
+func (s *localStore) persistSensitive(idx *index, meta *SecretMeta, value string) error {
+	if meta.Backend == "" {
+		resolved, err := s.backends.ResolveForNewSecret(s.preference, idx)
 		if err != nil {
 			return err
 		}
-		return b.remove(backendKey(meta.Context, meta.Name))
+		meta.Backend = resolved
+	}
+	b, err := s.backends.Open(meta.Backend, idx, true)
+	if err != nil {
+		return err
+	}
+	if err := b.set(backendKey(meta.Context, meta.Name), value); err != nil {
+		return err
+	}
+	if s.keySource != "" {
+		idx.data.KeySource = string(s.keySource)
 	}
 	return nil
 }
 
+func (s *localStore) removeSensitive(idx *index, meta *SecretMeta) error {
+	if err := s.checkKeySource(idx); err != nil {
+		return err
+	}
+	b, err := s.backends.Open(meta.Backend, idx, false)
+	if err != nil {
+		return err
+	}
+	return b.remove(backendKey(meta.Context, meta.Name))
+}
+
 func (s *localStore) checkKeySource(idx *index) error {
 	if s.keySource == "" || idx.data.KeySource == "" || idx.data.KeySource == string(s.keySource) {
 		return nil
 	}
-	return fmt.Errorf("secrets were encrypted with the %q key source but the current source is %q; restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets", idx.data.KeySource, s.keySource)
+	return fmt.Errorf(
+		"secrets were encrypted with the %q key source but the current source is %q; "+
+			"restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets",
+		idx.data.KeySource,
+		s.keySource,
+	)
 }
diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index ac99ca170..e03297915 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -357,7 +357,11 @@ func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	}
 
 	s := newLocalStore(newMapBackend(), path)
-	if _, err := s.Get(testContext, "LEGACY"); err == nil || !strings.Contains(err.Error(), "missing persisted backend ownership") {
+	if _, err := s.Get(
+		testContext,
+		"LEGACY",
+	); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
 		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
@@ -371,7 +375,11 @@ func TestStore_RejectsLegacyInlineSecret(t *testing.T) {
 	}
 
 	s := newLocalStore(newMapBackend(), path)
-	if _, err := s.Get(testContext, "LEGACY"); err == nil || !strings.Contains(err.Error(), "missing persisted backend ownership") {
+	if _, err := s.Get(
+		testContext,
+		"LEGACY",
+	); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
 		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }

From 1121724e9f9d382e8c0f9900551182acd617a0bf Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sat, 12 Sep 2026 13:43:25 -0600
Subject: [PATCH 03/13] fix(secrets): reuse recorded file key source

---
 pkg/secrets/local_store.go | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkg/secrets/local_store.go b/pkg/secrets/local_store.go
index 156f79105..07b0457f0 100644
--- a/pkg/secrets/local_store.go
+++ b/pkg/secrets/local_store.go
@@ -293,7 +293,7 @@ func (s *localStore) persistValue(
 	idx *index, meta *SecretMeta, value string, wasSensitive bool,
 ) error {
 	if meta.Sensitive() {
-		return s.persistSensitive(idx, meta, value)
+		return s.persistSensitive(idx, meta, value, !wasSensitive)
 	}
 	if wasSensitive {
 		return s.removeSensitive(idx, meta)
@@ -301,7 +301,9 @@ func (s *localStore) persistValue(
 	return nil
 }
 
-func (s *localStore) persistSensitive(idx *index, meta *SecretMeta, value string) error {
+func (s *localStore) persistSensitive(
+	idx *index, meta *SecretMeta, value string, create bool,
+) error {
 	if meta.Backend == "" {
 		resolved, err := s.backends.ResolveForNewSecret(s.preference, idx)
 		if err != nil {
@@ -309,7 +311,7 @@ func (s *localStore) persistSensitive(idx *index, meta *SecretMeta, value string
 		}
 		meta.Backend = resolved
 	}
-	b, err := s.backends.Open(meta.Backend, idx, true)
+	b, err := s.backends.Open(meta.Backend, idx, create)
 	if err != nil {
 		return err
 	}

From 7624df730a3c4e763fe5174b6a073b2bb3cccb24 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sat, 12 Sep 2026 17:10:01 -0600
Subject: [PATCH 04/13] test(gpg): allow macOS runner startup overhead

---
 pkg/gpg/gpg_forwarding_test.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkg/gpg/gpg_forwarding_test.go b/pkg/gpg/gpg_forwarding_test.go
index 3f9bce892..cfafaa4dc 100644
--- a/pkg/gpg/gpg_forwarding_test.go
+++ b/pkg/gpg/gpg_forwarding_test.go
@@ -107,7 +107,9 @@ func TestClaimForwardedSocket_StopsPollingAsSoonAsSocketAppears(t *testing.T) {
 	err := g.claimForwardedSocket(context.Background())
 	elapsed := time.Since(start)
 
-	assert.Less(t, elapsed, 2*time.Second, "must return shortly after the socket appears")
+	// macOS runners can spend several seconds on the first sudo invocation;
+	// retain a bounded guard without making the test depend on runner startup.
+	assert.Less(t, elapsed, 5*time.Second, "must return shortly after the socket appears")
 	if err != nil {
 		var exitErr *exec.ExitError
 		var execErr *exec.Error

From ceb75ad35e7e5ae83454cfe2bdc13039cc47b45c Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 13 Sep 2026 13:55:54 -0600
Subject: [PATCH 05/13] test(secrets): remove legacy terminology

---
 pkg/secrets/store_internal_test.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index e03297915..81fa992f9 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -179,7 +179,7 @@ func TestStore_ListSorted(t *testing.T) {
 	}
 }
 
-func TestStore_ReconcileFlagsOrphans(t *testing.T) {
+func TestStore_ListFlagsMissingValues(t *testing.T) {
 	mb := newMapBackend()
 	s := newTestStore(t, mb)
 
@@ -351,7 +351,7 @@ func TestFileBackend_AutoKeyRoundTrip(t *testing.T) {
 
 func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
-	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n      context: default\n"
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n      context: default\n"
 	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
 		t.Fatal(err)
 	}
@@ -359,16 +359,16 @@ func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	s := newLocalStore(newMapBackend(), path)
 	if _, err := s.Get(
 		testContext,
-		"LEGACY",
+		"UNOWNED",
 	); err == nil ||
 		!strings.Contains(err.Error(), "missing persisted backend ownership") {
 		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
 
-func TestStore_RejectsLegacyInlineSecret(t *testing.T) {
+func TestStore_RejectsInlineSecretWithoutOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
-	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n" +
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n" +
 		"      context: default\n      value: leaked\n"
 	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
 		t.Fatal(err)
@@ -377,7 +377,7 @@ func TestStore_RejectsLegacyInlineSecret(t *testing.T) {
 	s := newLocalStore(newMapBackend(), path)
 	if _, err := s.Get(
 		testContext,
-		"LEGACY",
+		"UNOWNED",
 	); err == nil ||
 		!strings.Contains(err.Error(), "missing persisted backend ownership") {
 		t.Fatalf("expected missing backend ownership error, got %v", err)

From e667a614577e068a92f7acc36f6982ff60c4d719 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 13 Sep 2026 17:36:56 -0600
Subject: [PATCH 06/13] ci: refresh cached podman archive

---
 .github/workflows/pr-ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index efe227cb7..7a0440dc8 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -757,7 +757,9 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/podman-linux-amd64.tar.gz
-          key: ${{ runner.os }}-${{ runner.arch }}-podman-static-v5.8.4
+          # Bump this key when the cached archive is found to be corrupted so
+          # rootless jobs download a fresh verified archive.
+          key: ${{ runner.os }}-${{ runner.arch }}-podman-static-v5.8.4-sha256-v2
 
       - name: install podman (Linux)
         if: (matrix.install-podman == 'rootless' || matrix.install-podman == 'rootful') && runner.os == 'Linux'

From a45163580f9ab1d8df879ddf68f348dce39803c7 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 13 Sep 2026 22:19:30 -0500
Subject: [PATCH 07/13] style: remove comment

---
 .github/workflows/pr-ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 7a0440dc8..f07e9ba55 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -757,8 +757,6 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/podman-linux-amd64.tar.gz
-          # Bump this key when the cached archive is found to be corrupted so
-          # rootless jobs download a fresh verified archive.
           key: ${{ runner.os }}-${{ runner.arch }}-podman-static-v5.8.4-sha256-v2
 
       - name: install podman (Linux)

From 74f629f7f37c514290b4ab4282edfbf3124c67db Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 13 Sep 2026 22:20:39 -0500
Subject: [PATCH 08/13] style: remove comment

---
 pkg/secrets/local_store.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkg/secrets/local_store.go b/pkg/secrets/local_store.go
index 07b0457f0..9ff05ddab 100644
--- a/pkg/secrets/local_store.go
+++ b/pkg/secrets/local_store.go
@@ -31,9 +31,7 @@ type localStore struct {
 	backends   backendRegistry
 	indexPath  string
 	now        func() time.Time
-	// Retained for compatibility with the file-backed test seam. System stores
-	// validate the source when opening the concrete file backend.
-	keySource keySource
+	keySource  keySource
 }
 
 func NewStoreForConfig(devsyConfig *config.Config) (Store, error) {

From 0c562997e0e1f92e7d24737609217d3417e789c4 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 13 Sep 2026 22:21:10 -0500
Subject: [PATCH 09/13] style: remove comment

---
 pkg/gpg/gpg_forwarding_test.go | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkg/gpg/gpg_forwarding_test.go b/pkg/gpg/gpg_forwarding_test.go
index cfafaa4dc..5a93853a7 100644
--- a/pkg/gpg/gpg_forwarding_test.go
+++ b/pkg/gpg/gpg_forwarding_test.go
@@ -107,8 +107,6 @@ func TestClaimForwardedSocket_StopsPollingAsSoonAsSocketAppears(t *testing.T) {
 	err := g.claimForwardedSocket(context.Background())
 	elapsed := time.Since(start)
 
-	// macOS runners can spend several seconds on the first sudo invocation;
-	// retain a bounded guard without making the test depend on runner startup.
 	assert.Less(t, elapsed, 5*time.Second, "must return shortly after the socket appears")
 	if err != nil {
 		var exitErr *exec.ExitError

From c53b7d6b15d351a11731b12eda57dd6379d3ef4e Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Tue, 15 Sep 2026 08:35:01 -0600
Subject: [PATCH 10/13] test(secrets): cover backend loading errors

---
 .../renderer/src/lib/stores/secrets.test.ts   | 27 +++++++++++++++++++
 pkg/gpg/gpg_forwarding_test.go                |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/desktop/src/renderer/src/lib/stores/secrets.test.ts b/desktop/src/renderer/src/lib/stores/secrets.test.ts
index 6cff95c59..32f2bec13 100644
--- a/desktop/src/renderer/src/lib/stores/secrets.test.ts
+++ b/desktop/src/renderer/src/lib/stores/secrets.test.ts
@@ -6,6 +6,7 @@ import {
   initSecrets,
   refreshSecrets,
   secrets,
+  secretsError,
   secretsLoading,
 } from "./secrets.js"
 
@@ -13,6 +14,7 @@ describe("secrets store", () => {
   beforeEach(() => {
     resetTauriMocks()
     secrets.set([])
+    secretsError.set(null)
     secretsLoading.set(true)
   })
 
@@ -36,6 +38,19 @@ describe("secrets store", () => {
 
     expect(get(secretsLoading)).toBe(false)
     expect(get(secrets)).toEqual([])
+    expect(get(secretsError)).toBe("IPC not available")
+  })
+
+  it("clears the init error after a successful retry", async () => {
+    mockInvoke
+      .mockRejectedValueOnce(new Error("IPC not available"))
+      .mockResolvedValueOnce([{ name: "TOKEN", context: "default" }])
+
+    await initSecrets()
+    expect(get(secretsError)).toBe("IPC not available")
+
+    await initSecrets()
+    expect(get(secretsError)).toBeNull()
   })
 
   it("refreshSecrets updates the store", async () => {
@@ -46,4 +61,16 @@ describe("secrets store", () => {
     expect(get(secrets)).toHaveLength(1)
     expect(get(secrets)[0].name).toBe("TOKEN")
   })
+
+  it("clears the refresh error after a successful retry", async () => {
+    mockInvoke
+      .mockRejectedValueOnce(new Error("IPC not available"))
+      .mockResolvedValueOnce([{ name: "TOKEN", context: "default" }])
+
+    await refreshSecrets()
+    expect(get(secretsError)).toBe("IPC not available")
+
+    await refreshSecrets()
+    expect(get(secretsError)).toBeNull()
+  })
 })
diff --git a/pkg/gpg/gpg_forwarding_test.go b/pkg/gpg/gpg_forwarding_test.go
index 5a93853a7..3f9bce892 100644
--- a/pkg/gpg/gpg_forwarding_test.go
+++ b/pkg/gpg/gpg_forwarding_test.go
@@ -107,7 +107,7 @@ func TestClaimForwardedSocket_StopsPollingAsSoonAsSocketAppears(t *testing.T) {
 	err := g.claimForwardedSocket(context.Background())
 	elapsed := time.Since(start)
 
-	assert.Less(t, elapsed, 5*time.Second, "must return shortly after the socket appears")
+	assert.Less(t, elapsed, 2*time.Second, "must return shortly after the socket appears")
 	if err != nil {
 		var exitErr *exec.ExitError
 		var execErr *exec.Error

From 5b3e9dc38dcbeeddc18759ead5808faf2c098615 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Tue, 15 Sep 2026 10:01:15 -0600
Subject: [PATCH 11/13] fix(secrets): reject unowned index entries

---
 pkg/secrets/index.go               |  7 +++++++
 pkg/secrets/store_internal_test.go | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/pkg/secrets/index.go b/pkg/secrets/index.go
index 866be9bba..43cc2b733 100644
--- a/pkg/secrets/index.go
+++ b/pkg/secrets/index.go
@@ -83,6 +83,13 @@ func (i *index) validateBackends() error {
 					name,
 				)
 			}
+			if meta.Backend == "" {
+				return fmt.Errorf(
+					"secret %s/%s is missing persisted backend ownership",
+					context,
+					name,
+				)
+			}
 		}
 	}
 	return nil
diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index 81fa992f9..e2407b583 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -366,6 +366,19 @@ func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	}
 }
 
+func TestLoadIndex_RejectsMissingBackendOwnership(t *testing.T) {
+	path := filepath.Join(t.TempDir(), IndexFileName)
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n      context: default\n"
+	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := loadIndex(path); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
+	}
+}
+
 func TestStore_RejectsInlineSecretWithoutOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
 	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n" +

From 62c6fdf970f5f4db291c95a91efadaa415684ed2 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Tue, 15 Sep 2026 10:19:38 -0600
Subject: [PATCH 12/13] refactor(secrets): simplify backend validation

---
 pkg/secrets/index.go | 57 +++++++++++++++++++++++++-------------------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/pkg/secrets/index.go b/pkg/secrets/index.go
index 43cc2b733..6b9ec2646 100644
--- a/pkg/secrets/index.go
+++ b/pkg/secrets/index.go
@@ -64,37 +64,44 @@ func (i *index) normalizeKinds() {
 func (i *index) validateBackends() error {
 	for context, entries := range i.data.Contexts {
 		for name, meta := range entries {
-			if meta.Kind == KindEnv {
-				if meta.Backend != "" {
-					return fmt.Errorf(
-						"invalid backend %q for environment entry %s/%s",
-						meta.Backend,
-						context,
-						name,
-					)
-				}
-				continue
-			}
-			if meta.Backend != "" && meta.Backend != BackendKeyring && meta.Backend != BackendFile {
-				return fmt.Errorf(
-					"invalid secrets backend %q for %s/%s",
-					meta.Backend,
-					context,
-					name,
-				)
-			}
-			if meta.Backend == "" {
-				return fmt.Errorf(
-					"secret %s/%s is missing persisted backend ownership",
-					context,
-					name,
-				)
+			if err := validateBackend(context, name, meta); err != nil {
+				return err
 			}
 		}
 	}
 	return nil
 }
 
+func validateBackend(context, name string, meta SecretMeta) error {
+	if meta.Kind == KindEnv {
+		if meta.Backend != "" {
+			return fmt.Errorf(
+				"invalid backend %q for environment entry %s/%s",
+				meta.Backend,
+				context,
+				name,
+			)
+		}
+		return nil
+	}
+	if meta.Backend == "" {
+		return fmt.Errorf(
+			"secret %s/%s is missing persisted backend ownership",
+			context,
+			name,
+		)
+	}
+	if meta.Backend != BackendKeyring && meta.Backend != BackendFile {
+		return fmt.Errorf(
+			"invalid secrets backend %q for %s/%s",
+			meta.Backend,
+			context,
+			name,
+		)
+	}
+	return nil
+}
+
 func (i *index) save() error {
 	out, err := yaml.Marshal(i.data)
 	if err != nil {

From 042032387cc29980f211eeac22d1944b995b99e4 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Tue, 15 Sep 2026 15:46:18 -0600
Subject: [PATCH 13/13] test(secrets): verify recorded backend ownership

---
 pkg/secrets/store_internal_test.go | 54 ++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index e2407b583..44c833336 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -2,6 +2,7 @@ package secrets
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -9,6 +10,7 @@ import (
 
 	"filippo.io/age"
 	"github.com/devsy-org/devsy/pkg/config"
+	"github.com/stretchr/testify/require"
 )
 
 const testContext = "default"
@@ -75,6 +77,25 @@ type mapBackend struct {
 
 func newMapBackend() *mapBackend { return &mapBackend{values: map[string]string{}} }
 
+type mapBackendRegistry struct {
+	backends map[Backend]*mapBackend
+}
+
+func (r mapBackendRegistry) Open(kind Backend, _ *index, _ bool) (backend, error) {
+	b, ok := r.backends[kind]
+	if !ok {
+		return nil, fmt.Errorf("missing test backend %q", kind)
+	}
+	return b, nil
+}
+
+func (r mapBackendRegistry) ResolveForNewSecret(preference Backend, _ *index) (Backend, error) {
+	if _, ok := r.backends[preference]; !ok {
+		return "", fmt.Errorf("missing test backend %q", preference)
+	}
+	return preference, nil
+}
+
 func (m *mapBackend) set(key, value string) error {
 	m.values[key] = value
 	return nil
@@ -229,6 +250,39 @@ func TestStore_SetUpdatePreservesCreated(t *testing.T) {
 	}
 }
 
+func TestStore_UsesRecordedBackendAfterPreferenceChanges(t *testing.T) {
+	keyring := newMapBackend()
+	file := newMapBackend()
+	indexPath := filepath.Join(t.TempDir(), IndexFileName)
+	s := newLocalStoreWithRegistry(BackendKeyring, indexPath, mapBackendRegistry{
+		backends: map[Backend]*mapBackend{
+			BackendKeyring: keyring,
+			BackendFile:    file,
+		},
+	})
+
+	require.NoError(t, s.Set(testContext, "TOKEN", "v1", KindSecret))
+	meta, err := s.Meta(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, BackendKeyring, meta.Backend)
+
+	s.preference = BackendFile
+	got, err := s.Get(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, "v1", got)
+	require.NoError(t, s.Set(testContext, "TOKEN", "v2", KindSecret))
+	list, err := s.List(testContext)
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.Equal(t, BackendKeyring, list[0].Backend)
+	got, err = s.Get(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, "v2", got)
+	require.NoError(t, s.Delete(testContext, "TOKEN"))
+	require.NotContains(t, keyring.values, backendKey(testContext, "TOKEN"))
+	require.NotContains(t, file.values, backendKey(testContext, "TOKEN"))
+}
+
 func TestValidateName(t *testing.T) {
 	valid := []string{"API_KEY", "db_password", "TOKEN2", "a"}
 	for _, n := range valid {