KNELSecretsManager

9 Commits

Author	SHA1	Message	Date
ic-builder	659883f1d2	ci: retrigger diagrams job (chromium fix verification) ci / vet (push) Successful in 1m1s Details ci / diagrams (push) Failing after 2m20s Details Ticket: https://projects.knownelement.com/issues/832	2026-09-07 10:02:20 -05:00
ic-builder	cf4094b9e4	smcli: self-healing sessions — refresh-token grant + auto-relogin ci / vet (pull_request) Successful in 1m9s Details Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 09:43:50 -05:00
ic-builder	e3c8e43ffb	docs QA: diagrams must parse in a real mermaid renderer ci / vet (pull_request) Successful in 55s Details ci / diagrams (pull_request) Failing after 2m45s Details The first architecture set did not render (backslash-n escapes, semicolons in sequence messages, braces in text). All diagrams rewritten to conservative syntax and QA-verified with mermaid-cli (3/3 PARSE-OK). qa-diagrams.sh added; CI enforces it on docs changes. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 19:29:04 -05:00
ic-builder	9e0cf6aa33	docs: production architecture (mermaid), KNELBMS integration, README ci / vet (push) Successful in 1m15s Details ci / vet (pull_request) Successful in 1m7s Details Component + sequence + rotation-flow diagrams; consumer pattern; KNELBMS secrets-flow table + provisioning sequence; README to prod standard. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 19:03:32 -05:00
ic-builder	68ba03c1af	smcli setfield: surgical single-field rotation updates; env exposes login triple ci / vet (push) Successful in 1m2s Details Rotation waves need per-field updates on login items without touching the rest (password/username/custom fields), and consumers need URI/ USERNAME/PASSWORD surfaced by env. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 18:52:34 -05:00
ic-builder	907ddb6000	smcli env: emit URI/USERNAME/PASSWORD for consumers; pin v5 ci / vet (push) Successful in 55s Details convert of login items keeps original env names in fields; env now also exposes the login triple so sourced consumers can map to legacy names. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 17:23:22 -05:00
ic-builder	0dcf41a839	smcli: login-item support + convert command (notes -> username/password/apikey) ci / vet (push) Successful in 36s Details Founder follow-up: lifted items restructured to proper login items (first-class username/password/URIs, remainder as named custom fields). Classified from the env-key semantics; zero data loss. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 16:53:22 -05:00
ic-builder	ee52682499	Merge pull request 'pure-Go smcli: replaces upstream Rust bw (ADR-003)' (#1 ) from ic-builder/go-smcli into main ci / vet (push) Failing after 12s Details	2026-09-06 21:46:09 +00:00
ic-builder	4728b3cff0	pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw ci / vet (pull_request) Failing after 12s Details Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 16:45:45 -05:00