---
id: w6/m11/t003
title: "m4 residual: live-verify the OpenBao tenant-secrets purge on workspace delete"
worker: worker6
status: todo
estimate: 30m
depends_on: [w6/m11/t001]
---

## Objective

Close m4's documented residual: prove against a real OpenBao that deleting a workspace purges its `tenants/*` secrets — m4 shipped the purger implemented and unit-tested but never fired live.

## Context

- `w6/done/m4/README.md`: "OpenBao secrets purge implemented + unit-tested but not live-verified".
- Purgers are injected into `lego/backend/internal/workspaces/service.go` (`Purgers []WorkspacePurger`, run by `Delete`); composition in `lego/backend/internal/api/server.go`.
- Tenant secrets live under the `tenants/*` mount (docs/ADR013-secrets.md).

## Steps

1. Create a throwaway workspace; set an env var on a service in it (or seed a secret at its `tenants/<id>` path directly).
2. Confirm the secret exists in OpenBao; delete the workspace through the API.
3. Confirm the path is gone (and that an unrelated workspace's secrets survive). Record evidence in the milestone README.

## Files

- `.pm/w6/m11/README.md` (evidence)

## Acceptance criteria

- [ ] Seeded secret confirmed present before delete, absent after; unrelated workspace's secrets untouched
- [ ] Evidence recorded in the milestone README

## Out of scope

- Postgres/KeyValue purgers (already live-verified in m4)
