I'm seeing sec_ok failures in the compiler bootstrap from around at least 3072c3a8. Possibly these came out of the refs branch? I'll need to run it interactively to investigate..