# TASK: keyproxy v0 — file backend (mpk_ placeholder interface, live)

## Context
Charles (2026-08-28 ~21:30): the credential gateway is key infrastructure.
This account has NO Bitwarden access, so v0 runs on a FILE backend over
~/.creds-style env files. The `mpk_...` placeholder interface ships NOW;
Bitwarden REST + Vault KV v2/AppRole backends swap in later behind the same
interface (phase 3, already specced in the repo README — read it first).
Consumers only ever see `mpk-<name>` refs; real material crosses the wire
at resolve time, memory-only, never persisted, never logged.

## Scope
1. Clone `https://git.knownelement.com/ukrrs/mopac-keyproxy` to
   `~/projects/meta/MOPAC/keyproxy` (spec README + LICENSE already there).
2. Implement v0 in Go (stdlib only):
   - `keyproxy serve` — localhost HTTP (default :8082, configurable):
     `POST /v1/resolve` body `{"ref":"mpk-redmine"}` → `{"value":"..."}`
     (mask value in any log line as `mpk-redmine=***`).
   - Backends behind one interface:
     - `file:` — env-file format (KEY=VALUE lines, 0600) at a configured
       path; ref maps to file+key. Sources tonight: `~/.creds/redmine.env`,
       `/home/_crossfeed/tooling/credentials/litellm-secrets.env`,
       `~/.coordinate/secrets/mopac-harness-vkey.env`.
     - `env:` — process env indirection.
     - `bitwarden:` / `vault:` — stubs returning explicit "not implemented
       in v0" errors (interface + tests only, so phase 3 is a drop-in).
   - Auth: bearer token for /v1/resolve, bootstrapped from the file backend
     itself (a `mpk-keyproxy-self` entry), 0600 file, never logged.
   - Config: `keyproxy.toml` — port + ref map (ref → backend/source/key).
     `keyproxy.toml.example` tracked; real config gitignored.
3. Rules (non-negotiable, from DESIGN.md keyproxy section):
   - No admin UI. No persistence. No key material in logs, errors, or
     crash paths (assert redaction in tests).
   - Never exec() env files; parse KEY=VALUE in Go.
   - Resolution failures name the ref and backend, never the value.

## Build discipline
- ALL DEV IN DOCKER: digest-pinned golang:1.26 builder container, repo
  bind-mounted; Makefile targets (build/vet/test) route through docker run.
  No host Go toolchain use.

## Deliverables
- Commits pushed to ukrrs/mopac-keyproxy main.
- Docs per standard (Charles's decree): README quickstart with verified
  copy-paste curl-equivalent (python3 urllib) resolve example, config
  reference table, status table.
- Table-driven tests incl. redaction + fake-HTTP end-to-end.
- `REPORT-20260828-2130-keyproxy-v0.md` in `~/.coordinate/inbox-pmo/`:
  what runs, how to start it, the ref map seeded, stub status.