From 6bd6aefbe826bcb3e48ad448afcef0429e2ed61d Mon Sep 17 00:00:00 2001 From: leetcrypt Date: Fri, 19 Jun 2026 19:09:12 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20bitwarden=20adapter=20promoted=20MOCK-O?= =?UTF-8?q?NLY=20=E2=86=92=20LIVE-VM?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Proven end to end (scan → plan → commit → restore-from-backup) against real bw 2026.5.0 driving a self-hosted Vaultwarden 1.36; fake account minted via real registration crypto. No adapter code changed. Only 1Password remains MOCK-ONLY (needs a real account, no self-host). Proof recorded as DATA in §8. Co-Authored-By: Claude Opus 4.6 --- docs/BROWSER-ROTATION.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/BROWSER-ROTATION.md b/docs/BROWSER-ROTATION.md index 79e09db..794923c 100644 --- a/docs/BROWSER-ROTATION.md +++ b/docs/BROWSER-ROTATION.md @@ -7,8 +7,8 @@ custody → **mandatory backup** → rotate/verify/commit → guide) — it is * Status: **Phase B (propagation engine) — built.** `pwgen` + `pwstore` (all five adapters) + the sealed staged-list + the `incredigo passwords scan|plan|guide|commit` surface are -implemented and tested (keepassxc + chrome/firefox staging are LIVE-VM proven; bitwarden / -1password still MOCK-ONLY — see §8). Phases +implemented and tested (bitwarden + keepassxc + chrome/firefox staging are LIVE-VM proven; +only 1password is still MOCK-ONLY — see §8). Phases A-tier-1 / A-tier-2 (site automation) are specified here but **not yet built**. Nothing in this doc changes a password **at a website** automatically — the human still performs the site change + MFA; incredigo only propagates the new value into the *manager* afterward. @@ -220,17 +220,19 @@ entries additionally record that a flag-gated plaintext file was created **and s ## 8. Validation status (DATA, mirrors `rotate/proofs.go` philosophy) The adapters contain ONLY real CLI/CSV code — no test branches. What differs is how each -write path has been *validated*. **bitwarden / 1password** are still **MOCK-ONLY** (exercised -against a fake `bw`/`op` binary). **keepassxc is LIVE-VM** — proven end to end -(`scan → plan → commit → restore-from-backup`) against the genuine `keepassxc-cli 2.7.6` -(`lab-provision-keepass.sh`). **chrome / firefox** are **LIVE-VM for the staging machinery** +write path has been *validated*. **1password** is still **MOCK-ONLY** (exercised against a +fake `op` binary — it genuinely needs a real account, no self-host). **bitwarden is LIVE-VM** — +proven end to end (`scan → plan → commit → restore-from-backup`) against the genuine `bw 2026.5.0` +CLI driving a self-hosted **Vaultwarden 1.36** (`lab-provision-bitwarden.sh`, fake account minted +via real registration crypto). **keepassxc is LIVE-VM** — proven end to end against the genuine +`keepassxc-cli 2.7.6` (`lab-provision-keepass.sh`). **chrome / firefox** are **LIVE-VM for the staging machinery** (real `/dev/shm` tmpfs + secure shred, correct per-browser layout) via `lab-provision-browsercsv.sh`; only the final human re-import is unproven (see note ²). All in the `incredigo-sbx` sandbox VM. | Adapter | Write shape | Secret path off-argv? | Validated against | |-----------|------------------------|-----------------------|-------------------| -| bitwarden | `bw edit item` (stdin) | **yes** — base64 on stdin | fake `bw` (MOCK-ONLY) | +| bitwarden | `bw edit item` (stdin) | **yes** — base64 on stdin | **real bw 2026.5.0 + Vaultwarden 1.36 (LIVE-VM)** | | keepassxc | `keepassxc-cli edit -p`| **yes** — db+new pass on stdin | **real keepassxc-cli 2.7.6 (LIVE-VM)** | | 1password | `op item edit pw=…` | **no** — argv assignment¹ | fake `op` (MOCK-ONLY) | | chrome | tmpfs CSV → human re-import | n/a (no live secret to a child) | **real /dev/shm + shred (LIVE-VM²)** |