2 Commits

Author	SHA1	Message	Date
leetcrypt	71a74e7166	guide: read-only guided manual-rotation layer (links + worklist + TUI) ... Advances the guided-rotation goal without rotating anything. - internal/links: offline change-password URL generation — curated per-service table + RFC 8615 /.well-known/change-password + parent-domain fallback; derives a web host from a credential (git/netrc "user @ host", docker registry, aws) - internal/worklist: secrets-free rotation worklist (source, identity, auto/manual, link) + Markdown renderer - internal/tui: Bubble Tea walk-through (one credential per screen, open link, mark done/skip, progress) — READ-ONLY, enters/stores no secret - cmd: `incredigo worklist` (offline, stdout/--out) and `incredigo guide` (TUI) - tests: link derivation, worklist build/markdown + no-secret-column, TUI navigation/done/quit/view Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 14:58:23 -07:00
leetcrypt	6c2bcebc12	docs: add project CLAUDE.md — rotation directive + safety guardrails ... Operational directive for Claude sessions: the headless two-mode rotation goal, current phase, and the non-negotiable guardrails (backup-before-rotate, verify-before-revoke, no-plaintext-on-disk / browser worklist not dump, GOPASS_HOMEDIR test isolation, self-owned-accounts scope, PGP passphrase = root of trust). Chosen stack: Bubble Tea + go-rod + .well-known/change-password. docs/ROTATION.md Part II (capability matrix, TUI walkthrough, link gen, browser worklist, automation tiers) is updated on disk but stays gitignored (local-only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 13:29:56 -07:00