10 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
ic-builder	b3caef6888	CI diagrams: install chromium + expose renderer stderr ... The diagrams job ran without a browser (the earlier fix landed on a deleted branch by mistake). Now installs Debian chromium, points puppeteer at it, and prints mmdc stderr on failure. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 10:08:24 -05:00
ic-builder	659883f1d2	ci: retrigger diagrams job (chromium fix verification) ... Ticket: https://projects.knownelement.com/issues/832	2026-09-07 10:02:20 -05:00
ic-builder	cf4094b9e4	smcli: self-healing sessions — refresh-token grant + auto-relogin ... Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 09:43:50 -05:00
ic-builder	e3c8e43ffb	docs QA: diagrams must parse in a real mermaid renderer ... The first architecture set did not render (backslash-n escapes, semicolons in sequence messages, braces in text). All diagrams rewritten to conservative syntax and QA-verified with mermaid-cli (3/3 PARSE-OK). qa-diagrams.sh added; CI enforces it on docs changes. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 19:29:04 -05:00
ic-builder	9e0cf6aa33	docs: production architecture (mermaid), KNELBMS integration, README ... Component + sequence + rotation-flow diagrams; consumer pattern; KNELBMS secrets-flow table + provisioning sequence; README to prod standard. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 19:03:32 -05:00
ic-builder	68ba03c1af	smcli setfield: surgical single-field rotation updates; env exposes login triple ... Rotation waves need per-field updates on login items without touching the rest (password/username/custom fields), and consumers need URI/ USERNAME/PASSWORD surfaced by env. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 18:52:34 -05:00
ic-builder	907ddb6000	smcli env: emit URI/USERNAME/PASSWORD for consumers; pin v5 ... convert of login items keeps original env names in fields; env now also exposes the login triple so sourced consumers can map to legacy names. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 17:23:22 -05:00
ic-builder	0dcf41a839	smcli: login-item support + convert command (notes -> username/password/apikey) ... Founder follow-up: lifted items restructured to proper login items (first-class username/password/URIs, remainder as named custom fields). Classified from the env-key semantics; zero data loss. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 16:53:22 -05:00
ic-builder	ee52682499	Merge pull request 'pure-Go smcli: replaces upstream Rust bw (ADR-003)' (#1) from ic-builder/go-smcli into main	2026-09-06 21:46:09 +00:00
ic-builder	4728b3cff0	pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw ... Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 16:45:45 -05:00