ticket: use base32 project record ids

2026-06-09 22:10:47 +09:00
parent 0803bc3725
commit 4203988d74
798 changed files with 477 additions and 105 deletions
@@ -0,0 +1,46 @@
+Implemented and merged local key-value secret store support.
+
+Merged commits:
+
+- `cc2c9a2 secrets: add local key store`
+- `7ddf745 secrets: polish key manager and docs`
+- `629159a merge: local secret store`
+
+Review:
+
+- Review approved in `c9e48b3 review: approve local secret store`.
+- Focused follow-up review approved the docs example and key-manager terminal cleanup polish.
+
+Summary:
+
+- Added a provider-independent local `id -> value` secret store under the user data directory.
+- Added id validation, atomic persistence, and lightweight at-rest obfuscation consistent with the ticket's modest security target.
+- Added `insomnia keys` interactive TUI management for listing ids, setting values with masked display, deleting with confirmation, and quitting without displaying plaintext values.
+- Wired provider `secret_ref` auth through the store.
+- Added WebSearch `api_key_secret` and removed normal WebSearch/provider credential env configuration.
+- Updated bundled resources and docs to point users to `insomnia keys` plus explicit secret refs.
+- Left Codex OAuth behavior unchanged.
+
+Validation after merge:
+
+- `cargo fmt --check` — passed
+- `cargo test -p secrets` — passed
+- `cargo test -p manifest secret --lib` — passed
+- `cargo test -p provider secret --lib` — passed
+- `cargo test -p tools web::tests::search_requires_configuration --lib` — passed
+- `cargo test -p tools web::tests::searches_brave_with_secret_ref --lib` — passed
+- `cargo test -p tools web::tests::searches_brave_with_bounded_output --lib` — passed
+- `cargo test -p tui keys::tests --lib` — passed
+- `cargo test -p insomnia parse_keys_subcommand --bin insomnia` — passed
+- `cargo check -p manifest -p provider -p tools -p tui -p insomnia` — passed
+- `./tickets.sh doctor` — passed
+- `git diff --check` — passed
+
+Credential/env grep:
+
+- `api_key_env`, `BRAVE_SEARCH_API_KEY`, `INSOMNIA_API_KEY`, and `default_env_var` are absent from `crates docs resources` after the merge.
+- Remaining `sk-`/`secret-value`/`test-secret` hits are fake test values, docs/comments, or Codex OAuth test fixtures, not new persisted real credentials.
+
+Caveat:
+
+- The store should continue to be described as local obfuscation / limited at-rest protection, not a high-assurance password manager.
@@ -0,0 +1,34 @@
+# Review: local key-value secret store implementation
+
+Implementation reviewed on branch `manifest-profile-encrypted-secrets`.
+
+Reviewed commits:
+
+- `cc2c9a2 secrets: add local key store`
+- `7ddf745 secrets: polish key manager and docs`
+
+Verdict: approve.
+
+Summary:
+
+- Core provider-independent `id -> value` local secret store satisfies the ticket model.
+- Store values are not persisted as casual plaintext and error/debug surfaces avoid secret values within the stated modest protection boundary.
+- Provider auth now resolves explicit `secret_ref` values through the local store without env credential fallback.
+- WebSearch uses explicit `api_key_secret` and no longer depends on `BRAVE_SEARCH_API_KEY` / `api_key_env` in the normal path.
+- `insomnia keys` provides interactive list/add-set/delete management without displaying plaintext values.
+- Codex OAuth behavior remains separate and unchanged.
+- Follow-up review confirmed the docs credential example is schema-valid and key-manager terminal setup cleanup was added.
+
+Validation reported by coder/reviewer:
+
+- `cargo fmt --check`
+- `cargo test -p secrets`
+- focused manifest/provider/tools/tui/insomnia tests
+- `cargo check -p manifest -p provider -p tools -p tui -p insomnia`
+- `./tickets.sh doctor`
+- `git diff --check`
+- credential/env greps confirming `api_key_env`, `BRAVE_SEARCH_API_KEY`, `INSOMNIA_API_KEY`, and `default_env_var` are absent from crates/docs/resources
+
+Remaining caveat:
+
+- Continue to describe this as local obfuscation / limited at-rest protection, not a high-assurance password manager or OS-keychain-backed vault.