mopac-pmo/archive/TASK-20260828-2130-keyproxy-v0.md

TASK: keyproxy v0 — file backend (mpk_ placeholder interface, live)

Context

Charles (2026-08-28 ~21:30): the credential gateway is key infrastructure. This account has NO Bitwarden access, so v0 runs on a FILE backend over ~/.creds-style env files. The mpk_... placeholder interface ships NOW; Bitwarden REST + Vault KV v2/AppRole backends swap in later behind the same interface (phase 3, already specced in the repo README — read it first). Consumers only ever see mpk-<name> refs; real material crosses the wire at resolve time, memory-only, never persisted, never logged.

Scope

1. Clone https://git.knownelement.com/ukrrs/mopac-keyproxy to ~/projects/meta/MOPAC/keyproxy (spec README + LICENSE already there).
2. Implement v0 in Go (stdlib only):
   • keyproxy serve — localhost HTTP (default :8082, configurable): POST /v1/resolve body {"ref":"mpk-redmine"} → {"value":"..."} (mask value in any log line as mpk-redmine=***).
   • Backends behind one interface:
     • file: — env-file format (KEY=VALUE lines, 0600) at a configured path; ref maps to file+key. Sources tonight: ~/.creds/redmine.env, /home/_crossfeed/tooling/credentials/litellm-secrets.env, ~/.coordinate/secrets/mopac-harness-vkey.env.
     • env: — process env indirection.
     • bitwarden: / vault: — stubs returning explicit "not implemented in v0" errors (interface + tests only, so phase 3 is a drop-in).
   • Auth: bearer token for /v1/resolve, bootstrapped from the file backend itself (a mpk-keyproxy-self entry), 0600 file, never logged.
   • Config: keyproxy.toml — port + ref map (ref → backend/source/key). keyproxy.toml.example tracked; real config gitignored.
3. Rules (non-negotiable, from DESIGN.md keyproxy section):
   • No admin UI. No persistence. No key material in logs, errors, or crash paths (assert redaction in tests).
   • Never exec() env files; parse KEY=VALUE in Go.
   • Resolution failures name the ref and backend, never the value.

Build discipline

• ALL DEV IN DOCKER: digest-pinned golang:1.26 builder container, repo bind-mounted; Makefile targets (build/vet/test) route through docker run. No host Go toolchain use.

Deliverables

• Commits pushed to ukrrs/mopac-keyproxy main.
• Docs per standard (Charles's decree): README quickstart with verified copy-paste curl-equivalent (python3 urllib) resolve example, config reference table, status table.
• Table-driven tests incl. redaction + fake-HTTP end-to-end.
• REPORT-20260828-2130-keyproxy-v0.md in ~/.coordinate/inbox-pmo/: what runs, how to start it, the ref map seeded, stub status.