docs: add ROADMAP + STATE snapshot, refresh CLAUDE.md dev state (M0)
Record the 2026-07-14 development snapshot and the roadmap to a deployable rotation system. Update CLAUDE.md "Where development is" — the stale entry claimed zero rotation drivers; reality is 22 drivers + a wired Mode A execute spine (8 LIVE-VM / 14 MOCK-ONLY). Gitignore the incredigo-map.html build artifact and the local rotation runbook. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
@@ -0,0 +1,115 @@
|
||||
# incredigo — state snapshot (2026-07-14)
|
||||
|
||||
Point-in-time assessment at commit `d237098`. Companion doc: [`ROADMAP.md`](ROADMAP.md)
|
||||
(how to proceed). Visual map: `incredigo-map.html` (repo root, regenerate with
|
||||
`/project-map`, build artifact).
|
||||
|
||||
## TL;DR
|
||||
|
||||
- **v1 custody pipeline is done and solid**: discover → vault → migrate → status →
|
||||
sealed export/import. 179 tests green across 13 packages, `-race` clean.
|
||||
- **Rotation is much further along than CLAUDE.md claims**: 22 drivers exist and
|
||||
self-register; the Mode A `--execute` spine is wired behind
|
||||
`INCREDIGO_ALLOW_EXECUTE=1` + the mandatory verified-backup gate. 8 drivers are
|
||||
LIVE-VM proven, 14 MOCK-ONLY. **No real (host) credential has been rotated yet** —
|
||||
that remains explicitly gated pending per-credential authorization.
|
||||
- **Guided manual layer works end-to-end**: `worklist` + `guide` (TUI) with offline
|
||||
change-URL derivation (49 curated sites + RFC 8615).
|
||||
- **Phase B (browser/password-manager turnover) is scaffolded, not wired**:
|
||||
12 pwstore adapters + pwgen + staging exist; `passwords pw-*` subcommands are in
|
||||
design phase.
|
||||
- **Weakest links**: `internal/sink` 30% coverage (the sealers — safety-critical),
|
||||
`cmd/incredigo` 4.3% (no CLI integration tests), lab-provision scripts referenced
|
||||
by `proofs.go` are not in the repo, no CI.
|
||||
|
||||
## Component inventory
|
||||
|
||||
| Layer | Package | What exists | Status |
|
||||
|---|---|---|---|
|
||||
| Custody | `internal/vault` | memguard arena (mlock/DONTDUMP/zeroize), Handle indirection | done |
|
||||
| Discover | `internal/discover` | 9 scanners: aws, env, netrc, ssh, docker, kube, git, tea, file(`--path`) + service-prefix detection (GitHub PAT, Stripe) | done |
|
||||
| Custody/backup | `internal/sink` | gopass stdin streaming, bundle framing, sealers age/hmac/openssl | done, under-tested |
|
||||
| Policy | `internal/policy` | expiry engine, YAML, per-kind overrides | done |
|
||||
| Audit | `internal/audit` | append-only redacted JSONL | done |
|
||||
| Rotation | `internal/rotate` | Rotator iface, registry, **mandatory backup gate**, Mode A execute spine, dry-run noop, 22 drivers, proofs-as-data | wired, no LIVE-REAL proof yet |
|
||||
| Blast radius | `internal/blast` | read-only consumer map from non-secret markers | done |
|
||||
| Guided layer | `internal/links` / `worklist` / `tui` | offline change-URLs, secrets-free checklist, Bubble Tea walk-through | done |
|
||||
| Phase B | `internal/pwstore` / `pwgen` / `cmd/.../passwords.go` | 12 manager adapters (bw, op, keepassxc, pass, keychain, chrome/firefox + 8 CSV managers), staging, generation | scaffolded, not wired end-to-end |
|
||||
| CLI | `cmd/incredigo` | scan, migrate, status, export, import, rotate, worklist, guide, passwords | done except passwords |
|
||||
|
||||
## Rotation driver proof matrix (from `internal/rotate/proofs.go` — single source of truth)
|
||||
|
||||
**LIVE-VM (8)** — real target software in sandbox VM: postgres, mysql (MariaDB),
|
||||
redis, mongo (mongod 8.0), wireguard, gitea, appsecret, k8s (k3s v1.35).
|
||||
|
||||
**MOCK-ONLY (14)** — httptest/emulator/fake-binary only: aws (moto), sshkey,
|
||||
openwrt, mullvad, cloudflare, ghactions, gitlab, npm (real registry needs password
|
||||
— known caveat), gcp (real RS256 JWT self-auth), twilio, flyio, resend, vercel,
|
||||
sendgrid.
|
||||
|
||||
**LIVE-REAL (0)** — the level doesn't exist yet in code; adding it is roadmap M2.
|
||||
|
||||
All drivers follow create→verify→revoke (or in-place ALTER for DBs) and contain
|
||||
only real service code (no simulation branches — proof status is data, per project
|
||||
rule).
|
||||
|
||||
## Test coverage (go test ./... -cover, 2026-07-14)
|
||||
|
||||
| Package | Coverage | Assessment |
|
||||
|---|---|---|
|
||||
| internal/vault | 100.0% | ✅ |
|
||||
| internal/worklist | 100.0% | ✅ |
|
||||
| internal/links | 93.8% | ✅ |
|
||||
| internal/blast | 92.1% | ✅ |
|
||||
| internal/audit | 90.5% | ✅ |
|
||||
| internal/pwgen | 84.1% | ✅ |
|
||||
| internal/pwstore | 78.4% | ok |
|
||||
| internal/rotate | 76.4% | ok (26s runtime: fake bins + httptest) |
|
||||
| internal/discover | 71.9% | ok |
|
||||
| internal/policy | 65.8% | ⚠ parsing edge cases |
|
||||
| internal/tui | 57.1% | ⚠ Update() only, View()/Run() untested |
|
||||
| **internal/sink** | **30.0%** | ❌ sealers + gopass wrapper barely tested — safety-critical gap |
|
||||
| **cmd/incredigo** | **4.3%** | ❌ no CLI integration tests |
|
||||
|
||||
Test quality where coverage exists is high: table-driven, secret-leak assertions,
|
||||
real-cutover proofs (old cred stops working), fake gopass/psql binaries,
|
||||
in-process SSH servers, httptest emulators.
|
||||
|
||||
## Demos buildable today (zero new code)
|
||||
|
||||
1. **Sprawl audit (safest, most impressive)** — on any machine:
|
||||
`incredigo scan` → `incredigo status` → `incredigo worklist --out rotate.md` →
|
||||
`incredigo guide`. Read-only, no secrets printed, TUI opens change-URLs.
|
||||
2. **Custody round-trip** — isolated store (`GOPASS_HOMEDIR=$(mktemp -d)` +
|
||||
throwaway GNUPGHOME): fixture `.env`/`.aws` → `migrate` → `export` (age) →
|
||||
wipe → `import` → verify. Demonstrates "no plaintext ever on disk".
|
||||
3. **Rotation dry-run + blast radius** — `rotate --dry-run --blast` over a fixture
|
||||
repo: shows the backup gate firing, the plan table with PROOF column, and which
|
||||
files consume each credential.
|
||||
4. **LIVE-VM rotation** — Multipass sandbox VM (see local runbook): provision
|
||||
postgres/redis/gitea with fake creds, `rotate --execute` with
|
||||
`INCREDIGO_ALLOW_EXECUTE=1`, show old cred dead / new cred live / sealed
|
||||
backup restorable. The full end-to-end story, zero real-cred risk.
|
||||
5. **Phase B ingest** — `passwords pw-scan` against a fixture browser CSV /
|
||||
throwaway KeePassXC DB (scan only; plan/commit not wired).
|
||||
|
||||
## Known gaps & risks
|
||||
|
||||
1. **`internal/sink` 30% coverage** — the sealers guard every backup the rotation
|
||||
gate depends on. Tamper/round-trip/wrong-passphrase tests missing. Highest-value
|
||||
test work in the repo.
|
||||
2. **No CLI integration tests** (cmd 4.3%) — flag plumbing, gate refusals
|
||||
(`--execute` without env var, no-passphrase, backup-verify failure) are untested
|
||||
at the command level.
|
||||
3. **Lab-provision scripts not in repo** — `proofs.go` cites
|
||||
`lab-provision-{pg,dbclones,wg,gitea,appsec,mongo,k8s}.sh` but they live only in
|
||||
the VM/runbook. LIVE-VM proofs are not reproducible from a fresh clone.
|
||||
4. **No CI** — gitea remote exists; branch upstream is gone (`master...origin/master
|
||||
[gone]`); nothing runs build/vet/test -race on push.
|
||||
5. **CLAUDE.md "Where development is" is stale (2026-06-15)** — claims "zero
|
||||
rotation drivers exist"; reality is 22 drivers + wired execute spine.
|
||||
6. **Phase B not wired** — adapters exist but pw-plan→pw-commit flow incomplete.
|
||||
7. **No scheduled turnover** — `status` knows what's stale; nothing acts on it
|
||||
headlessly yet (roadmap M3).
|
||||
8. **npm caveat** — real registry token creation requires the account password;
|
||||
driver can never leave MOCK-ONLY without a design decision.
|
||||
Reference in New Issue
Block a user