ops(archive): TASK prompts and REPORT verifications, studies through V1

2026-08-29 05:22:43 -05:00
parent bd0cea1757
commit b2c4b74d76
37 changed files with 2049 additions and 0 deletions
@@ -0,0 +1,49 @@
+# TASK: keyproxy v0 — file backend (mpk_ placeholder interface, live)
+
+## Context
+Charles (2026-08-28 ~21:30): the credential gateway is key infrastructure.
+This account has NO Bitwarden access, so v0 runs on a FILE backend over
+~/.creds-style env files. The `mpk_...` placeholder interface ships NOW;
+Bitwarden REST + Vault KV v2/AppRole backends swap in later behind the same
+interface (phase 3, already specced in the repo README — read it first).
+Consumers only ever see `mpk-<name>` refs; real material crosses the wire
+at resolve time, memory-only, never persisted, never logged.
+
+## Scope
+1. Clone `https://git.knownelement.com/ukrrs/mopac-keyproxy` to
+   `~/projects/meta/MOPAC/keyproxy` (spec README + LICENSE already there).
+2. Implement v0 in Go (stdlib only):
+   - `keyproxy serve` — localhost HTTP (default :8082, configurable):
+     `POST /v1/resolve` body `{"ref":"mpk-redmine"}` → `{"value":"..."}`
+     (mask value in any log line as `mpk-redmine=***`).
+   - Backends behind one interface:
+     - `file:` — env-file format (KEY=VALUE lines, 0600) at a configured
+       path; ref maps to file+key. Sources tonight: `~/.creds/redmine.env`,
+       `/home/_crossfeed/tooling/credentials/litellm-secrets.env`,
+       `~/.coordinate/secrets/mopac-harness-vkey.env`.
+     - `env:` — process env indirection.
+     - `bitwarden:` / `vault:` — stubs returning explicit "not implemented
+       in v0" errors (interface + tests only, so phase 3 is a drop-in).
+   - Auth: bearer token for /v1/resolve, bootstrapped from the file backend
+     itself (a `mpk-keyproxy-self` entry), 0600 file, never logged.
+   - Config: `keyproxy.toml` — port + ref map (ref → backend/source/key).
+     `keyproxy.toml.example` tracked; real config gitignored.
+3. Rules (non-negotiable, from DESIGN.md keyproxy section):
+   - No admin UI. No persistence. No key material in logs, errors, or
+     crash paths (assert redaction in tests).
+   - Never exec() env files; parse KEY=VALUE in Go.
+   - Resolution failures name the ref and backend, never the value.
+
+## Build discipline
+- ALL DEV IN DOCKER: digest-pinned golang:1.26 builder container, repo
+  bind-mounted; Makefile targets (build/vet/test) route through docker run.
+  No host Go toolchain use.
+
+## Deliverables
+- Commits pushed to ukrrs/mopac-keyproxy main.
+- Docs per standard (Charles's decree): README quickstart with verified
+  copy-paste curl-equivalent (python3 urllib) resolve example, config
+  reference table, status table.
+- Table-driven tests incl. redaction + fake-HTTP end-to-end.
+- `REPORT-20260828-2130-keyproxy-v0.md` in `~/.coordinate/inbox-pmo/`:
+  what runs, how to start it, the ref map seeded, stub status.