mats
0f8ed97878
The key store holds only SHA-256 hashes + metadata (no plaintext keys) and is read by other services in their own containers running as different non-root uids. saveLocked wrote it 0600, so when the backoffice pod (running as root) minted or revoked a key the file became root-owned 0600 — unreadable to the ledger/cart services, freezing their mtime-reload snapshots: new keys 401'd and revocations never took effect. Write 0644 so every reader reloads. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>