# TASK: mopac-bitwarden-go v0 — Secrets Manager REST client (fake-server tested)

## Context
keyproxy v0 is LIVE (ukrrs/mopac-keyproxy: file/env backends, `bitwarden:`
backend is a 501 stub awaiting this library). Charles: the credential
gateway is key infrastructure; Bitwarden backend is phase 3. This account
has NO Bitwarden access today — so v0 is built and tested entirely against
a FAKE Bitwarden Secrets Manager REST server in tests; live creds attach
later with zero code change.

## Inputs to read first
- `~/projects/meta/MOPAC/harness/docs/PORTING-NOTES-secrets.md` — design
  sketch + 7 open questions; answer what code can answer, list the rest.
- The spec README already seeded in the repo.
- Public Bitwarden Secrets Manager API docs (machine accounts: client_id +
  client_secret -> access token via /identity/connect/token,
  client_credentials grant; then /api/accounts/{id}/secrets etc.).
  Plain REST only — the official SDK is source-available and
  AGPL-incompatible (DESIGN.md), do NOT import it.

## Scope
1. Clone `https://git.knownelement.com/ukrrs/mopac-bitwarden-go` to
   `~/projects/meta/MOPAC/bitwarden-go` (default branch main).
2. Go package + thin CLI (`bitwarden-go`):
   - `login` — exchange machine credentials (from env refs or 0600 file,
     NEVER flags/args) for an access token; memory-only, refresh before
     expiry; never logged.
   - `projects` / `secrets list` / `get <key>` — read paths keyproxy needs.
   - Library surface: `Authenticate(ctx, creds) (Token, error)`,
     `GetSecret(ctx, token, key) (string, error)` — keyproxy's `bitwarden:`
     backend will call exactly this.
3. Fake server in tests: table-driven, covers auth failure, expiry,
   missing secret, malformed payloads, redaction assertions (token/secret
   values never in logs or errors).
4. Config via env-file (0600) — same KEY=VALUE discipline as keyproxy.
   No admin UI, no persistence of tokens to disk. EVER.
5. Docs per the standard: README (purpose, status line, verified
   quickstart against the fake server, config table).

## Build discipline
- ALL DEV IN DOCKER: digest-pinned golang:1.26 builder, repo bind-mounted;
  Makefile/dev.sh pattern copied from ukrrs/mopac-keyproxy.
- NEVER broad pkill — kill exact PIDs you spawned.
- Commits in logical chunks, push to origin main.

## Deliverable
`REPORT-20260828-2330-bitwarden-go.md` in `~/.coordinate/inbox-pmo/`:
library surface, CLI usage, fake-server test results, the open questions
still needing Charles, and the exact keyproxy integration point.