[antoinetoussaint-byte]

service-secrets is the one service-scoped block that accepts only a bare service name. The validator admits the module-qualified form for service-identity, service-mesh, service-config and build-images (pkg/environments/workspace.go:289), and RemoteRef looks the mapping up by scope.Service alone (environment.go:1246) — even though SecretScope documents the module as the thing that keeps two modules stores apart.

A bare name cannot name a service whose name several modules declare. Eleven modules of platform-obin each ship a store, so those stores cannot be named in service-secrets at all:

environment "blue" service-secrets references unknown service "tracing/store"
environment "blue" service-secrets references unknown service "documents/vector"

That matters because without an explicit reference, every store POSTGRES_USER falls through to the dev plaintext its own module ships (.../services/store/configurations/local/postgres.secret.env), which every hosted cell reads as the last link of its configuration-profiles chain, and service-postgres refuses a value where it requires a typed Secret reference for all four primitives (builder.go:937-953):

builder deploy failed: postgres deployment requires a typed Kubernetes Secret reference
for CODEFLY__SERVICE_SECRET_CONFIGURATION__MODEL__STORE__POSTGRES__POSTGRES_USER

So today no hosted cell of that composition can be rendered at all. (The same render on 0.1.219 projected those keys as secretKeyRefs; the committed blue tree still shows them.)

Change

• EnvironmentServiceSecrets.MappingFor(module, service): the qualified entry wins, the bare entry stays for a name only one module declares — which is how every environment written before this states its services.
• RemoteRef and both configuration_projection.go readers use it, so validation, render and the projection check agree.
• The validator admits the qualified form for service-secrets as it already does for the other four blocks.

Tests

pkg/environments/environment_remote_ref_qualified_test.go: two modules store resolve to different remote entries; a module with no entry still falls to the environment template with its own module substituted; a bare entry keeps working. go build ./..., go vet, go test ./pkg/environments/ ./pkg/gitops/ all pass (gitops 104s).

🤖 Generated with Claude Code