Trace secret resolution can fail in macOS dark wake

[chubes4]

Problem\n\nA runner-offloaded Woo Stripe real-wallet trace failed before execution while resolving --secret-env from the local project keychain:\n\nKeychain error: Platform secure storage failure: In dark wake, no UI possible\n\nThis happened after updating Homeboy to 0.228.18 / ee86dd9 and restarting the homeboy-lab runner.\n\n## Why this matters\n\n--secret-env is the canonical path for forwarding secrets to Lab traces without printing values. For real-wallet Woo Stripe evidence, the trace needs STRIPE_PUBLISHABLE_KEY and STRIPE_SECRET_KEY. If the controller is in macOS dark wake or otherwise unable to prompt/read Keychain, the trace cannot start.\n\n## Expected\n\nHomeboy should provide a clear headless-safe path for trace secrets, such as:\n\n- prefer process env values when present,\n- support agent-task auth source: env mappings for trace secrets without Keychain access, or\n- fail with a diagnostic that tells the operator exactly how to rerun without a Keychain UI.\n\n## Evidence\n\nFailed command shape:\n\nhomeboy --runner homeboy-lab --force-hot trace compare woocommerce-gateway-stripe ece-product-page-waterfall --rig woocommerce-stripe-ece-product-page --baseline-target origin/develop --candidate 0631a0a1d5f6856c960f4224efa7d3f03787d666 --profile real-wallet --repeat 1 --schedule interleaved --setting woocommerce_stripe_ece_preview_port=49828 --setting woocommerce_stripe_ece_preview_public_url=https://cd12840249c8b9299278-49828-tunnel.kimaki.dev --setting woocommerce_stripe_accepted_payment_methods=card,link,apple_pay,google_pay --setting woocommerce_stripe_ece_require_fanout_proof=1 --secret-env STRIPE_PUBLISHABLE_KEY --secret-env STRIPE_SECRET_KEY\n\nReturned error:\n\nPlatform secure storage failure: In dark wake, no UI possible\n\n## Related\n\n- Follow-up from Woo Stripe proof work.\n- Related stale WP Codebox proof blocker: #4140\n- Prior secret caching fix: #4137\n\n## AI assistance\n- AI assistance: Yes\n- Tool(s): OpenCode (GPT-5.5)\n- Used for: Drafting issue from observed trace failure and current Homeboy secret handling behavior.\n

[chubes4]

Additional context from follow-up: trace_secrets::resolve_secret_env already prefers process env before agent-task mappings and project keychain. The dark-wake Keychain failure happened because the Stripe vars were not exported in the controller process, so --secret-env fell through to stored keychain/project secret lookup.\n\nFor this run, the safest immediate workaround is to rerun from a shell where STRIPE_PUBLISHABLE_KEY and STRIPE_SECRET_KEY are exported, or from an unlocked user session, instead of relying on Keychain in dark wake.\n\nThis issue is still useful for UX: the failure should make that fallback order and env-first escape hatch obvious without requiring source inspection.\n\nAI assistance: OpenCode (GPT-5.5) used to inspect trace secret resolution and summarize findings.