Seed: keyproxy spec posture (placeholders, vault-authoritative, AGPLv3)

README.md

@@ -0,0 +1,18 @@
+# mopac-keyproxy
+
+A key-material proxy where the vault stays authoritative. Consumers receive
+opaque placeholder keys; real secrets live only in Bitwarden Secrets Manager
+and/or HashiCorp Vault and are resolved to real material at the wire, in
+memory, never persisted, with no admin UI to attack.
+
+- Placeholders in, real keys on the wire out (`mpk_...` refs; a leaked
+  placeholder is revoke-and-remap, not an incident).
+- Backends: Bitwarden Secrets Manager REST (machine accounts) and HashiCorp
+  Vault KV v2 + AppRole. Stdlib-first; no Bitwarden SDK (license).
+- Serves as both an HTTP hop and a CLI (`keyproxy get <ref>` for exec-style
+  plumbing).
+- AGPLv3. Part of the MOPAC family but standalone and composable: generic,
+  config-driven, no organizational assumptions baked into code.
+
+Status: specification phase (see MOPAC/harness/DESIGN.md, "Key proxy").
+Building 2026-08-28 onward.