v1.80.3

EvoMap/evolverv1.80.3May 7, 2026by autogame-17

AI Summary

Fixes a bug in proxy mode where environment overrides were undoing successful secret rotations during heartbeats.

Key Highlights

Hub-supplied secrets are now prioritized once persisted, preventing the env override from reverting them.
Added regression test to cover the specific failure path where the heartbeat overwrote the rotated secret.
Suppresses env override after a successful secret rotation.

Full Release Notes

## v1.80.3

### Fixes

- **proxy: env override no longer undoes a successful secret rotation** (#529 follow-up, Bugbot review on PR #22).

  v1.80.2 introduced an `A2A_NODE_SECRET` env-vs-store reconciliation that fires whenever the two values disagree. That reconciliation also fired during the verification heartbeat that runs right after `hello` rotates the secret, silently overwriting the freshly stored secret Z with the stale env value Y. The heartbeat would sign with Y, get a 403, and the proxy slipped back into the exact 30-minute auth loop the original patch fixed.

  v1.80.3: as soon as `hello` persists a hub-supplied fresh secret, the env override is suppressed for the rest of this process. Hub-supplied secrets are always newer than `A2A_NODE_SECRET`, so this locks in the right side of the conflict. The verification heartbeat now signs with the rotated secret as intended.

  New regression test in `test/lifecycleStaleNodeSecret.test.js` covers the exact path Bugbot flagged (env=Y, store=X stale, rotate to Z, verification heartbeat must use Z).

### Recommendation

If you are running v1.80.2 in proxy mode, please upgrade. v1.80.2 still fixes the original cold-start case, but if a stale `A2A_NODE_SECRET` was set and the hub triggered a rotation later, the heartbeat afterwards could silently revert. v1.80.3 closes that window.