Proven end to end (scan → plan → commit → restore-from-backup) against real
bw 2026.5.0 driving a self-hosted Vaultwarden 1.36; fake account minted via
real registration crypto. No adapter code changed. Only 1Password remains
MOCK-ONLY (needs a real account, no self-host). Proof recorded as DATA in §8.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
lab-provision-browsercsv.sh + csv-commit-probe.py drive the real `passwords
commit --allow-csv` path in the sandbox VM and assert the security-critical,
unattended machinery: the new-password CSV is written to a real tmpfs
(/dev/shm), in the correct per-browser column layout, carrying the staged
strong passwords with the OLD ones absent, then securely shredded once the
human confirms — and the user's own export CSV is left untouched. The final
re-import into the browser remains a human step (no programmatic import API),
so the proof is scoped to staging, not end-to-end browser write.
No adapter code changed; only the validation-status DATA in §8.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Proven end-to-end (scan→plan→commit→restore-from-backup) against the real
keepassxc-cli 2.7.6 in the incredigo-sbx sandbox VM. The live run surfaced an
adapter bug the fake CSV masked: KeePassXC's CSV "Group" column is the full path
including the root group name (default root is "Passwords"), but keepassxc-cli
addresses entries relative to root (/GitHub, not /Passwords/GitHub). kpEntryPath
now drops the leading root segment; the unit test that encoded the buggy
/Root/GitHub form is corrected and a nested-group table test added.
Records the proof as data: docs/BROWSER-ROTATION.md promotes keepassxc
MOCK-ONLY -> LIVE-VM (the others stay MOCK-ONLY).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add the secondary-persona path from docs/BROWSER-ROTATION.md: ingest a password
manager / browser store, take a mandatory verified sealed backup, generate fresh
strong passwords, hand the human a ready-to-finish task at the MFA wall, and commit
the new value into the manager only after the site change is confirmed.
- internal/pwgen: crypto/rand generator (rejection sampling, per-class guarantee,
vault-native — never returns plaintext as a Go string).
- internal/pwstore: Manager/ItemUpdater/BulkImporter contracts, secrets-free
RedactIdentity, and five adapters — bitwarden (bw, stdin), keepassxc
(keepassxc-cli, stdin), 1password (op, argv assignment with documented caveat),
chrome/firefox (tmpfs CSV ingest-and-shred). All real code; validation status is
data (MOCK-ONLY against fake binaries/CSVs, recorded in the design doc).
- internal/pwstore/stage.go: age-sealed staged-list (WriteStaged/ReadStaged) +
StagedImporter — the only artifacts crossing the plan->commit gap, never plaintext.
- cmd/incredigo: passwords scan|plan|guide|commit. Backup gate seals + round-trip
verifies before any commit; guide is interactive verify-before-commit; commit is
headless over a sealed stage. Browser CSV writes are gated behind --allow-csv.
Hard rules honored: backup-before-commit, verify-before-commit, no plaintext on
disk (browser CSV is the flag-gated tmpfs+shred exception), MFA always a human
handoff. go vet + -race clean; end-to-end verified against a fake bw.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt