Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/policy/policy.go

@@ -0,0 +1,119 @@
+// Package policy is the local-only expiry engine. It reads credential mtimes and
+// reports age against thresholds. No network calls in v1.
+package policy
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"gopkg.in/yaml.v3"
+
+	"incredigo/internal/discover"
+)
+
+type State string
+
+const (
+	OK    State = "ok"
+	Warn  State = "warn"
+	Stale State = "stale"
+)
+
+// Thresholds in days. Zero means "unset / no opinion".
+type Threshold struct {
+	WarnAfter  Days `yaml:"warn_after"`
+	StaleAfter Days `yaml:"stale_after"`
+}
+
+type Policy struct {
+	Defaults  Threshold                    `yaml:"defaults"`
+	Overrides map[discover.Kind]Threshold `yaml:"overrides"`
+}
+
+// Default policy used when no config file is present.
+func Default() Policy {
+	return Policy{
+		Defaults: Threshold{WarnAfter: 60, StaleAfter: 90},
+		Overrides: map[discover.Kind]Threshold{
+			discover.KindAWSKey:     {WarnAfter: 30, StaleAfter: 90},
+			discover.KindPrivateKey: {WarnAfter: 180},
+		},
+	}
+}
+
+// Load reads a YAML policy file, falling back to Default if path is empty or
+// missing.
+func Load(path string) (Policy, error) {
+	if path == "" {
+		return Default(), nil
+	}
+	b, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		return Default(), nil
+	}
+	if err != nil {
+		return Policy{}, err
+	}
+	p := Default()
+	if err := yaml.Unmarshal(b, &p); err != nil {
+		return Policy{}, err
+	}
+	return p, nil
+}
+
+// Evaluate returns the state and age for one credential.
+func (p Policy) Evaluate(c discover.Credential, now time.Time) (State, time.Duration) {
+	age := now.Sub(c.Modified)
+	t := p.Defaults
+	if ov, ok := p.Overrides[c.Kind]; ok {
+		if ov.WarnAfter != 0 {
+			t.WarnAfter = ov.WarnAfter
+		}
+		if ov.StaleAfter != 0 {
+			t.StaleAfter = ov.StaleAfter
+		}
+	}
+	switch {
+	case t.StaleAfter != 0 && age >= t.StaleAfter.Duration():
+		return Stale, age
+	case t.WarnAfter != 0 && age >= t.WarnAfter.Duration():
+		return Warn, age
+	default:
+		return OK, age
+	}
+}
+
+// Days is a day-count threshold. In policy.yaml it may be written either as a
+// bare integer (`60`) or with a unit suffix: `60d` (days) or `8w` (weeks). Zero
+// means "unset / no opinion".
+type Days int
+
+func (d Days) Duration() time.Duration { return time.Duration(d) * 24 * time.Hour }
+
+// UnmarshalYAML accepts a scalar that is either an integer count of days or a
+// string with a `d`/`w` unit suffix, so the DESIGN's `warn_after: 60d` form and a
+// plain `warn_after: 60` both work.
+func (d *Days) UnmarshalYAML(node *yaml.Node) error {
+	s := strings.TrimSpace(node.Value)
+	if s == "" {
+		*d = 0
+		return nil
+	}
+	mult := 1
+	switch s[len(s)-1] {
+	case 'd', 'D':
+		s = strings.TrimSpace(s[:len(s)-1])
+	case 'w', 'W':
+		mult = 7
+		s = strings.TrimSpace(s[:len(s)-1])
+	}
+	n, err := strconv.Atoi(s)
+	if err != nil {
+		return fmt.Errorf("policy: invalid day threshold %q (want e.g. 60, 60d, or 8w)", node.Value)
+	}
+	*d = Days(n * mult)
+	return nil
+}

internal/policy/policy_test.go

@@ -0,0 +1,82 @@
+package policy
+
+import (
+	"testing"
+	"time"
+
+	"gopkg.in/yaml.v3"
+
+	"incredigo/internal/discover"
+)
+
+func TestDaysUnmarshal(t *testing.T) {
+	ok := map[string]Days{
+		"60":     60,
+		"60d":    60,
+		"8w":     56,
+		"  90d ": 90,
+		"0":      0,
+	}
+	for in, want := range ok {
+		var d Days
+		if err := yaml.Unmarshal([]byte(in), &d); err != nil {
+			t.Errorf("%q: unexpected error %v", in, err)
+			continue
+		}
+		if d != want {
+			t.Errorf("%q: got %d want %d", in, d, want)
+		}
+	}
+	for _, bad := range []string{"60x", "abc", "d"} {
+		var d Days
+		if err := yaml.Unmarshal([]byte(bad), &d); err == nil {
+			t.Errorf("%q: expected error, got %d", bad, d)
+		}
+	}
+}
+
+func TestPolicyYAMLWithSuffixes(t *testing.T) {
+	src := `
+defaults:
+  warn_after: 60d
+  stale_after: 90d
+overrides:
+  private_key:
+    warn_after: 26w
+`
+	p := Default()
+	if err := yaml.Unmarshal([]byte(src), &p); err != nil {
+		t.Fatal(err)
+	}
+	if p.Defaults.WarnAfter != 60 || p.Defaults.StaleAfter != 90 {
+		t.Errorf("defaults = %+v", p.Defaults)
+	}
+	if p.Overrides[discover.KindPrivateKey].WarnAfter != 182 { // 26*7
+		t.Errorf("private_key warn_after = %d, want 182", p.Overrides[discover.KindPrivateKey].WarnAfter)
+	}
+}
+
+func TestEvaluate(t *testing.T) {
+	p := Default() // defaults 60/90; aws_key 30/90
+	now := time.Now()
+	aged := func(days int, kind discover.Kind) discover.Credential {
+		return discover.Credential{Kind: kind, Modified: now.Add(-time.Duration(days) * 24 * time.Hour)}
+	}
+
+	cases := []struct {
+		name string
+		cred discover.Credential
+		want State
+	}{
+		{"fresh token", aged(10, discover.KindToken), OK},
+		{"warn token", aged(70, discover.KindToken), Warn},
+		{"stale token", aged(100, discover.KindToken), Stale},
+		{"aws warns earlier", aged(40, discover.KindAWSKey), Warn},
+		{"aws fresh", aged(20, discover.KindAWSKey), OK},
+	}
+	for _, c := range cases {
+		if st, _ := p.Evaluate(c.cred, now); st != c.want {
+			t.Errorf("%s: got %s want %s", c.name, st, c.want)
+		}
+	}
+}