import importlib


def test_signature_uses_runtime_secret(monkeypatch):
    monkeypatch.setenv("CRYPTO_SECRET", "12345678override")
    crypto = importlib.import_module("crypto")
    assert crypto.derive_signature("payload") == "payload:override"