{"record":{"id":"232d8f9a179bfb48","repo":"tinyhumansai/openhuman","slug":"failed-to-load-secret-store-master-key-from-keycha","errorCode":null,"errorMessage":"Failed to load secret-store master key from keychain: {e} | detail={}","messagePattern":"Failed to load secret-store master key from keychain: (.+?) \\| detail=(.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/openhuman/security/keyring/encrypted_store.rs","lineNumber":239,"sourceCode":"            }\n            Ok(crate::openhuman::security::keyring::MigrationOutcome::AlreadyMigrated)\n            | Ok(crate::openhuman::security::keyring::MigrationOutcome::NoSourceFile) => {}\n            Err(error) => {\n                log::warn!(\n                    \"[security] failed to migrate legacy secret-store key from {}: {error} | detail={}\",\n                    self.key_path.display(),\n                    error.diagnostic()\n                );\n            }\n        }\n\n        let hex_key = crate::openhuman::security::keyring::get_or_create_random(\n            &user_id,\n            KEYCHAIN_MASTER_KEY,\n            KEY_LEN,\n        )\n        .map_err(|e| {\n            anyhow::anyhow!(\n                \"Failed to load secret-store master key from keychain: {e} | detail={}\",\n                e.diagnostic()\n            )\n        })?;\n        decode_key_hex(hex_key.trim())\n    }\n\n    /// Load the encryption key from keychain-backed storage, falling back to\n    /// the legacy file path only in unit tests.\n    ///\n    /// The decoded key is cached process-wide keyed by `key_path`, so repeated\n    /// callers (e.g. every `app_state_snapshot` poll) hit memory instead of\n    /// disk/keychain lookup.\n    ///\n    /// The key bytes are wrapped in [`Zeroizing`] so every copy — the returned\n    /// value, the cache entry, and any intermediate buffers — is wiped from\n    /// memory on drop rather than lingering in the heap/swap/core-dumps.\n    fn load_or_create_key(&self) -> Result<Zeroizing<Vec<u8>>> {","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/security/keyring/encrypted_store.rs#L221-L257","documentation":"Loading the secret-store master key from the OS keychain failed during encrypted-store initialization. This is the bootstrap step that obtains the 32-byte key guarding all at-rest secrets; a keychain read error (locked, missing backend, access denied) aborts the store. Legacy-file migration failures are deliberately tolerated nearby — this error is strictly the keychain read itself.","triggerScenarios":"Thrown at src/openhuman/security/keyring/encrypted_store.rs:239 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Unlock the OS keychain and retry","Verify the keyring backend is available in this environment (headless/container contexts often lack one)","Check keychain entry permissions for the app","Read `{e}` diagnostic detail for the backend-specific cause"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}