feat: complete Epic 1 production foundation

apps/mcp-server/tests/config_startup.rs

@@ -1,11 +1,21 @@
 use std::process::Command;
 
+use crank_registry::{
+    MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, MigrationAuthority, PostgresRegistry,
+};
+use crank_runtime::SecretCrypto;
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
+const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
+const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
+
 fn run_with(entries: &[(&str, &str)]) -> String {
     let mut command = Command::new(env!("CARGO_BIN_EXE_mcp-server"));
     for field in crank_config::field_registry() {
         command.env_remove(field.env_name);
     }
-    command.env("CRANK_MASTER_KEY", "master");
+    command.env("CRANK_MASTER_KEY", TEST_MASTER_KEY);
     for (name, value) in entries {
         command.env(name, value);
     }
@@ -63,3 +73,29 @@ async fn fresh_database_startup_is_read_only() {
     .unwrap();
     assert!(!present);
 }
+
+#[tokio::test]
+async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
+    let database_url = crank_test_support::postgres_schema_url("mcp_master_key_mismatch").await;
+    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
+    MigrationAuthority::apply(&pool).await.unwrap();
+    let registry = PostgresRegistry::connect(&database_url).await.unwrap();
+    let crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
+    registry
+        .verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
+            epoch: 1,
+            fingerprint: crypto.master_key_fingerprint(),
+            cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
+            observed_at: &OffsetDateTime::parse("2026-08-21T00:00:00Z", &Rfc3339).unwrap(),
+        })
+        .await
+        .unwrap();
+
+    let stderr = run_with(&[
+        ("CRANK_DATABASE_URL", &database_url),
+        ("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
+    ]);
+    assert!(stderr.contains("master_key_identity_mismatch"), "{stderr}");
+    assert!(!stderr.contains("registered-master-key"));
+    assert!(!stderr.contains("wrong-master-key"));
+}