incredigo/docs/STATE-2026-07-14.md

incredigo — state snapshot (2026-07-14)

Point-in-time assessment at commit d237098. Companion doc: ROADMAP.md (how to proceed). Visual map: incredigo-map.html (repo root, regenerate with /project-map, build artifact).

TL;DR

• v1 custody pipeline is done and solid: discover → vault → migrate → status → sealed export/import. 179 tests green across 13 packages, -race clean.
• Rotation is much further along than CLAUDE.md claims: 22 drivers exist and self-register; the Mode A --execute spine is wired behind INCREDIGO_ALLOW_EXECUTE=1 + the mandatory verified-backup gate. 8 drivers are LIVE-VM proven, 14 MOCK-ONLY. No real (host) credential has been rotated yet — that remains explicitly gated pending per-credential authorization.
• Guided manual layer works end-to-end: worklist + guide (TUI) with offline change-URL derivation (49 curated sites + RFC 8615).
• Phase B (browser/password-manager turnover) is scaffolded, not wired: 12 pwstore adapters + pwgen + staging exist; passwords pw-* subcommands are in design phase.
• Weakest links: internal/sink 30% coverage (the sealers — safety-critical), cmd/incredigo 4.3% (no CLI integration tests), lab-provision scripts referenced by proofs.go are not in the repo, no CI.

Component inventory

Layer	Package	What exists	Status
Custody	internal/vault	memguard arena (mlock/DONTDUMP/zeroize), Handle indirection	done
Discover	internal/discover	9 scanners: aws, env, netrc, ssh, docker, kube, git, tea, file(--path) + service-prefix detection (GitHub PAT, Stripe)	done
Custody/backup	internal/sink	gopass stdin streaming, bundle framing, sealers age/hmac/openssl	done, under-tested
Policy	internal/policy	expiry engine, YAML, per-kind overrides	done
Audit	internal/audit	append-only redacted JSONL	done
Rotation	internal/rotate	Rotator iface, registry, mandatory backup gate, Mode A execute spine, dry-run noop, 22 drivers, proofs-as-data	wired, no LIVE-REAL proof yet
Blast radius	internal/blast	read-only consumer map from non-secret markers	done
Guided layer	internal/links / worklist / tui	offline change-URLs, secrets-free checklist, Bubble Tea walk-through	done
Phase B	internal/pwstore / pwgen / cmd/.../passwords.go	12 manager adapters (bw, op, keepassxc, pass, keychain, chrome/firefox + 8 CSV managers), staging, generation	scaffolded, not wired end-to-end
CLI	cmd/incredigo	scan, migrate, status, export, import, rotate, worklist, guide, passwords	done except passwords

Rotation driver proof matrix (from internal/rotate/proofs.go — single source of truth)

LIVE-VM (8) — real target software in sandbox VM: postgres, mysql (MariaDB), redis, mongo (mongod 8.0), wireguard, gitea, appsecret, k8s (k3s v1.35).

MOCK-ONLY (14) — httptest/emulator/fake-binary only: aws (moto), sshkey, openwrt, mullvad, cloudflare, ghactions, gitlab, npm (real registry needs password — known caveat), gcp (real RS256 JWT self-auth), twilio, flyio, resend, vercel, sendgrid.

LIVE-REAL (0) — the level doesn't exist yet in code; adding it is roadmap M2.

All drivers follow create→verify→revoke (or in-place ALTER for DBs) and contain only real service code (no simulation branches — proof status is data, per project rule).

Test coverage (go test ./... -cover, 2026-07-14)

Package	Coverage	Assessment
internal/vault	100.0%	✅
internal/worklist	100.0%	✅
internal/links	93.8%	✅
internal/blast	92.1%	✅
internal/audit	90.5%	✅
internal/pwgen	84.1%	✅
internal/pwstore	78.4%	ok
internal/rotate	76.4%	ok (26s runtime: fake bins + httptest)
internal/discover	71.9%	ok
internal/policy	65.8%	⚠ parsing edge cases
internal/tui	57.1%	⚠ Update() only, View()/Run() untested
internal/sink	30.0%	❌ sealers + gopass wrapper barely tested — safety-critical gap
cmd/incredigo	4.3%	❌ no CLI integration tests

Test quality where coverage exists is high: table-driven, secret-leak assertions, real-cutover proofs (old cred stops working), fake gopass/psql binaries, in-process SSH servers, httptest emulators.

Demos buildable today (zero new code)

1. Sprawl audit (safest, most impressive) — on any machine: incredigo scan → incredigo status → incredigo worklist --out rotate.md → incredigo guide. Read-only, no secrets printed, TUI opens change-URLs.
2. Custody round-trip — isolated store (GOPASS_HOMEDIR=$(mktemp -d) + throwaway GNUPGHOME): fixture .env/.aws → migrate → export (age) → wipe → import → verify. Demonstrates "no plaintext ever on disk".
3. Rotation dry-run + blast radius — rotate --dry-run --blast over a fixture repo: shows the backup gate firing, the plan table with PROOF column, and which files consume each credential.
4. LIVE-VM rotation — Multipass sandbox VM (see local runbook): provision postgres/redis/gitea with fake creds, rotate --execute with INCREDIGO_ALLOW_EXECUTE=1, show old cred dead / new cred live / sealed backup restorable. The full end-to-end story, zero real-cred risk.
5. Phase B ingest — passwords pw-scan against a fixture browser CSV / throwaway KeePassXC DB (scan only; plan/commit not wired).

Known gaps & risks

1. internal/sink 30% coverage — the sealers guard every backup the rotation gate depends on. Tamper/round-trip/wrong-passphrase tests missing. Highest-value test work in the repo.
2. No CLI integration tests (cmd 4.3%) — flag plumbing, gate refusals (--execute without env var, no-passphrase, backup-verify failure) are untested at the command level.
3. Lab-provision scripts not in repo — proofs.go cites lab-provision-{pg,dbclones,wg,gitea,appsec,mongo,k8s}.sh but they live only in the VM/runbook. LIVE-VM proofs are not reproducible from a fresh clone.
4. No CI — gitea remote exists; branch upstream is gone (master...origin/master [gone]); nothing runs build/vet/test -race on push.
5. CLAUDE.md "Where development is" is stale (2026-06-15) — claims "zero rotation drivers exist"; reality is 22 drivers + wired execute spine.
6. Phase B not wired — adapters exist but pw-plan→pw-commit flow incomplete.
7. No scheduled turnover — status knows what's stale; nothing acts on it headlessly yet (roadmap M3).
8. npm caveat — real registry token creation requires the account password; driver can never leave MOCK-ONLY without a design decision.