---
id: w1/m10/t004
title: Live acceptance — PUT env-vars against prod end-to-end; update ADR013-secrets.md prod path
worker: worker1
status: done
estimate: 25m
depends_on: [w1/m10/t002]
---

## Objective

Prove the whole path on prod: set an env var via the prod API (or dashboard Environment tab) → value lands in OpenBao under `tenants/default/services/<svc>/env` → the `<svc>-env` Secret materializes → pods roll → the running app serves the new value. Then update docs/ADR013-secrets.md's "Prod deploy path" section from deferred to done.

## Context

- `scripts/secrets-verify.sh` already scripts this loop for the mock cluster — point it at prod (or add a prod mode).
- The value must survive a bex-api pod restart (store is the truth, not process memory).

## Steps

1. Run the verify loop against prod with a throwaway service.
2. Restart the bex-api pod; confirm the value still reads back.
3. Update docs/ADR013-secrets.md (Prod deploy path + the Consequences bullet) and run prettier.

## Files

- `scripts/secrets-verify.sh`
- `docs/ADR013-secrets.md`

## Acceptance criteria

- [ ] Prod `PUT /v1/services/{id}/env-vars` → 200; value visible in the app after rollout; survives an api pod restart.
- [ ] ADR013-secrets.md no longer describes CI wiring as deferred.

## Out of scope

- Tenant-scoped OpenBao paths beyond `default` (arrives with w1/m9 tenancy).
