# ADR-003: Custom Go CLI replaces the upstream Rust bw binary

Date: 2026-09-06. Decided by founder directive (finish the project with our
custom Go cli, not the upstream rust one; no Rust supply-chain risk).

## Decision

KNELSecretsManager ships a pure-Go CLI (`cli/cmd/smcli`) implementing the
Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
with 2FA (TOTP), key derivation + decryption (stretched master key, user
sym key), sync, item create/edit/delete with hidden fields.

The upstream Rust `bw` binary is RETIRED: bin/ scripts moved to
archive/rust-bw-era/. The CLI ships in our own container
(golang build -> alpine runtime, CA certs, non-root), delivered as the
always-hot compose service `ukrrs-secretsmgr-cli` and the lane shim
`.tools/sm`.

## Consequences

- No Rust/Node supply chain in the secrets tooling; Go module set is
  stdlib + golang.org/x/crypto.
- Vault account bootstrapping (password + TOTP) happens via docker exec
  from the TSGCOO env file; the container env_file holds non-secret config.
- Rotation waves (#829) rewire consumers from `bwlane.sh`/`.creds` to `sm`.