refactor: address PR review feedback on test credentials

- Fix TEST_CRYPTO_KEY doc comment ("32-byte hex" → "32-character key string")
- Rename confusing "real"/"fake" Anthropic constant names and values
- Change TEST_STRIPE_KEY from "sk-live" to "sk_test_fake123" to avoid scanners
- Use test_secrets_store() helper in orchestrator and http tool tests
- Clarify config_round_trip.rs doc comment about integration test visibility

Co-Authored-By: Claude Opus 4.6 <[email protected]>

src/config/sandbox.rs

@@ -408,10 +408,10 @@ mod tests {
     fn parse_oauth_token_valid() {
         let json = format!(
             r#"{{"claudeAiOauth": {{"accessToken": "{}"}}}}"#,
-            TEST_ANTHROPIC_OAUTH_FAKE
+            TEST_ANTHROPIC_OAUTH_BASIC
         );
         let token = parse_oauth_access_token(&json);
-        assert_eq!(token, Some(TEST_ANTHROPIC_OAUTH_FAKE.to_string()));
+        assert_eq!(token, Some(TEST_ANTHROPIC_OAUTH_BASIC.to_string()));
     }
 
     #[test]
@@ -446,11 +446,11 @@ mod tests {
                 "expiresAt": 1700000000
             }}
         }}"#,
-            TEST_ANTHROPIC_OAUTH_REAL
+            TEST_ANTHROPIC_OAUTH_NESTED
         );
         assert_eq!(
             parse_oauth_access_token(&json),
-            Some(TEST_ANTHROPIC_OAUTH_REAL.to_string())
+            Some(TEST_ANTHROPIC_OAUTH_NESTED.to_string())
         );
     }
 

src/orchestrator/api.rs

@@ -458,7 +458,6 @@ mod tests {
     use crate::orchestrator::auth::TokenStore;
     use crate::orchestrator::job_manager::{ContainerJobConfig, ContainerJobManager};
     use crate::testing::StubLlm;
-    use crate::testing::credentials::test_secrets_store;
 
     use super::*;
 
@@ -662,6 +661,7 @@ mod tests {
 
     #[tokio::test]
     async fn credentials_returns_secrets_when_store_configured() {
+        use crate::testing::credentials::test_secrets_store;
         use secrecy::SecretString;
         let secrets_store = Arc::new(test_secrets_store());
 

src/testing/credentials.rs

@@ -12,7 +12,7 @@ use crate::secrets::{InMemorySecretsStore, SecretsCrypto};
 
 // ── Encryption keys ──────────────────────────────────────────────────────
 
-/// 32-byte hex key for `SecretsCrypto::new()` in tests.
+/// 32-character key string for `SecretsCrypto::new()` in tests.
 pub const TEST_CRYPTO_KEY: &str = "0123456789abcdef0123456789abcdef";
 
 /// 32+ char key for web gateway `SecretsCrypto` in tests.
@@ -38,13 +38,13 @@ pub const TEST_OPENAI_API_KEY_ISSUE_129: &str = "sk-test-key-for-issue-129";
 pub const TEST_ANTHROPIC_OAUTH_TOKEN: &str = "sk-ant-oat01-test-token";
 
 /// Anthropic API key for priority tests.
-pub const TEST_ANTHROPIC_API_KEY: &str = "sk-ant-real-key";
+pub const TEST_ANTHROPIC_API_KEY: &str = "sk-ant-priority-key";
 
 /// Anthropic OAuth token for sandbox config parse tests.
-pub const TEST_ANTHROPIC_OAUTH_FAKE: &str = "sk-ant-oat01-fake";
+pub const TEST_ANTHROPIC_OAUTH_BASIC: &str = "sk-ant-oat01-basic";
 
 /// Anthropic OAuth token in nested JSON parse test.
-pub const TEST_ANTHROPIC_OAUTH_REAL: &str = "sk-ant-oat01-real-token";
+pub const TEST_ANTHROPIC_OAUTH_NESTED: &str = "sk-ant-oat01-primary-token";
 
 // ── Google OAuth ─────────────────────────────────────────────────────────
 
@@ -89,7 +89,7 @@ pub const TEST_AUTH_SECRET_TOKEN: &str = "secret-token";
 // ── Stripe ──────────────────────────────────────────────────────────────
 
 /// Stripe-style test key.
-pub const TEST_STRIPE_KEY: &str = "sk-live";
+pub const TEST_STRIPE_KEY: &str = "sk_test_fake123";
 
 // ── Redaction test values ───────────────────────────────────────────────
 

src/tools/builtin/http.rs

@@ -609,7 +609,7 @@ impl Tool for HttpTool {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::testing::credentials::{TEST_CRYPTO_KEY, TEST_OPENAI_API_KEY};
+    use crate::testing::credentials::{TEST_OPENAI_API_KEY, test_secrets_store};
 
     #[test]
     fn test_http_tool_schema_headers_is_array() {
@@ -869,12 +869,7 @@ mod tests {
         let tool = HttpTool::new().with_credentials(
             registry,
             // secrets_store is not used in requires_approval, just needs to be present
-            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
+            Arc::new(test_secrets_store()),
-                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
-                    TEST_CRYPTO_KEY.to_string(),
-                ))
-                .unwrap(),
-            ))),
         );
 
         let params = serde_json::json!({
@@ -891,15 +886,7 @@ mod tests {
         let registry = Arc::new(SharedCredentialRegistry::new());
         // Empty registry - no credential mappings
 
-        let tool = HttpTool::new().with_credentials(
+        let tool = HttpTool::new().with_credentials(registry, Arc::new(test_secrets_store()));
-            registry,
-            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
-                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
-                    TEST_CRYPTO_KEY.to_string(),
-                ))
-                .unwrap(),
-            ))),
-        );
 
         let params = serde_json::json!({
             "method": "GET",
@@ -958,15 +945,7 @@ mod tests {
         let registry = Arc::new(SharedCredentialRegistry::new());
         registry.add_mappings(vec![CredentialMapping::bearer("test_key", "api.test.com")]);
 
-        let tool = HttpTool::new().with_credentials(
+        let tool = HttpTool::new().with_credentials(registry, Arc::new(test_secrets_store()));
-            registry,
-            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
-                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
-                    TEST_CRYPTO_KEY.to_string(),
-                ))
-                .unwrap(),
-            ))),
-        );
 
         // These calls should not panic in multi-thread runtime
         let params_no_auth = serde_json::json!({

tests/config_round_trip.rs

@@ -12,8 +12,9 @@ use tempfile::tempdir;
 
 use ironclaw::bootstrap::{save_bootstrap_env_to, upsert_bootstrap_var_to};
 
-/// Fake OpenAI API key for test use only. Mirrors `TEST_OPENAI_API_KEY_LONG`
+/// Fake OpenAI API key for test use only. Mirrors the internal
-/// from `crate::testing::credentials` (unavailable in integration tests).
+/// `TEST_OPENAI_API_KEY_LONG` constant from the main crate, which is not
+/// directly available to integration tests due to `#[cfg(test)]`.
 const TEST_OPENAI_API_KEY_LONG: &str = "sk-test-key-1234567890";
 
 /// Parse a .env file into a HashMap using dotenvy.