- Shipped
- August 3, 2026 at 4:30 AM UTC
- Author
- Kamo
- Commit
- 0c3ac66
MfaEnrollmentService is a @Service and every Kamo service component-scans com.kamo, so it is instantiated in roughly forty applications. It had two constructors — one taking the configured key, one taking a cipher for tests — and Spring cannot choose between two candidates unannotated. A context test caught it: "Failed to instantiate MfaEnrollmentService: No default constructor found". That would have been a startup failure everywhere at once, caused by a feature nothing has called yet — the same trap the PHI audit recorder already hit once in this programme, which is why the test existed to catch it this time. Also pins that the context starts with NO key configured. Failing at startup would make deploying the code and configuring the secret an atomic operation across every service; failing at enrollment time keeps the blast radius to the feature, and it still refuses to store a secret in the clear.