incredigo/docs/STATE-2026-07-14.md

# incredigo — state snapshot (2026-07-14)

Point-in-time assessment at commit `d237098`. Companion doc: [`ROADMAP.md`](ROADMAP.md)
(how to proceed). Visual map: `incredigo-map.html` (repo root, regenerate with
`/project-map`, build artifact).

## TL;DR

- **v1 custody pipeline is done and solid**: discover → vault → migrate → status →
  sealed export/import. 179 tests green across 13 packages, `-race` clean.
- **Rotation is much further along than CLAUDE.md claims**: 22 drivers exist and
  self-register; the Mode A `--execute` spine is wired behind
  `INCREDIGO_ALLOW_EXECUTE=1` + the mandatory verified-backup gate. 8 drivers are
  LIVE-VM proven, 14 MOCK-ONLY. **No real (host) credential has been rotated yet** —
  that remains explicitly gated pending per-credential authorization.
- **Guided manual layer works end-to-end**: `worklist` + `guide` (TUI) with offline
  change-URL derivation (49 curated sites + RFC 8615).
- **Phase B (browser/password-manager turnover) is scaffolded, not wired**:
  12 pwstore adapters + pwgen + staging exist; `passwords pw-*` subcommands are in
  design phase.
- **Weakest links**: `internal/sink` 30% coverage (the sealers — safety-critical),
  `cmd/incredigo` 4.3% (no CLI integration tests), lab-provision scripts referenced
  by `proofs.go` are not in the repo, no CI.

## Component inventory

| Layer | Package | What exists | Status |
|---|---|---|---|
| Custody | `internal/vault` | memguard arena (mlock/DONTDUMP/zeroize), Handle indirection | done |
| Discover | `internal/discover` | 9 scanners: aws, env, netrc, ssh, docker, kube, git, tea, file(`--path`) + service-prefix detection (GitHub PAT, Stripe) | done |
| Custody/backup | `internal/sink` | gopass stdin streaming, bundle framing, sealers age/hmac/openssl | done, under-tested |
| Policy | `internal/policy` | expiry engine, YAML, per-kind overrides | done |
| Audit | `internal/audit` | append-only redacted JSONL | done |
| Rotation | `internal/rotate` | Rotator iface, registry, **mandatory backup gate**, Mode A execute spine, dry-run noop, 22 drivers, proofs-as-data | wired, no LIVE-REAL proof yet |
| Blast radius | `internal/blast` | read-only consumer map from non-secret markers | done |
| Guided layer | `internal/links` / `worklist` / `tui` | offline change-URLs, secrets-free checklist, Bubble Tea walk-through | done |
| Phase B | `internal/pwstore` / `pwgen` / `cmd/.../passwords.go` | 12 manager adapters (bw, op, keepassxc, pass, keychain, chrome/firefox + 8 CSV managers), staging, generation | scaffolded, not wired end-to-end |
| CLI | `cmd/incredigo` | scan, migrate, status, export, import, rotate, worklist, guide, passwords | done except passwords |

## Rotation driver proof matrix (from `internal/rotate/proofs.go` — single source of truth)

**LIVE-VM (8)** — real target software in sandbox VM: postgres, mysql (MariaDB),
redis, mongo (mongod 8.0), wireguard, gitea, appsecret, k8s (k3s v1.35).

**MOCK-ONLY (14)** — httptest/emulator/fake-binary only: aws (moto), sshkey,
openwrt, mullvad, cloudflare, ghactions, gitlab, npm (real registry needs password
— known caveat), gcp (real RS256 JWT self-auth), twilio, flyio, resend, vercel,
sendgrid.

**LIVE-REAL (0)** — the level doesn't exist yet in code; adding it is roadmap M2.

All drivers follow create→verify→revoke (or in-place ALTER for DBs) and contain
only real service code (no simulation branches — proof status is data, per project
rule).

## Test coverage (go test ./... -cover, 2026-07-14)

| Package | Coverage | Assessment |
|---|---|---|
| internal/vault | 100.0% | ✅ |
| internal/worklist | 100.0% | ✅ |
| internal/links | 93.8% | ✅ |
| internal/blast | 92.1% | ✅ |
| internal/audit | 90.5% | ✅ |
| internal/pwgen | 84.1% | ✅ |
| internal/pwstore | 78.4% | ok |
| internal/rotate | 76.4% | ok (26s runtime: fake bins + httptest) |
| internal/discover | 71.9% | ok |
| internal/policy | 65.8% | ⚠ parsing edge cases |
| internal/tui | 57.1% | ⚠ Update() only, View()/Run() untested |
| **internal/sink** | **30.0%** | ❌ sealers + gopass wrapper barely tested — safety-critical gap |
| **cmd/incredigo** | **4.3%** | ❌ no CLI integration tests |

Test quality where coverage exists is high: table-driven, secret-leak assertions,
real-cutover proofs (old cred stops working), fake gopass/psql binaries,
in-process SSH servers, httptest emulators.

## Demos buildable today (zero new code)

1. **Sprawl audit (safest, most impressive)** — on any machine:
   `incredigo scan` → `incredigo status` → `incredigo worklist --out rotate.md` →
   `incredigo guide`. Read-only, no secrets printed, TUI opens change-URLs.
2. **Custody round-trip** — isolated store (`GOPASS_HOMEDIR=$(mktemp -d)` +
   throwaway GNUPGHOME): fixture `.env`/`.aws` → `migrate` → `export` (age) →
   wipe → `import` → verify. Demonstrates "no plaintext ever on disk".
3. **Rotation dry-run + blast radius** — `rotate --dry-run --blast` over a fixture
   repo: shows the backup gate firing, the plan table with PROOF column, and which
   files consume each credential.
4. **LIVE-VM rotation** — Multipass sandbox VM (see local runbook): provision
   postgres/redis/gitea with fake creds, `rotate --execute` with
   `INCREDIGO_ALLOW_EXECUTE=1`, show old cred dead / new cred live / sealed
   backup restorable. The full end-to-end story, zero real-cred risk.
5. **Phase B ingest** — `passwords pw-scan` against a fixture browser CSV /
   throwaway KeePassXC DB (scan only; plan/commit not wired).

## Known gaps & risks

1. **`internal/sink` 30% coverage** — the sealers guard every backup the rotation
   gate depends on. Tamper/round-trip/wrong-passphrase tests missing. Highest-value
   test work in the repo.
2. **No CLI integration tests** (cmd 4.3%) — flag plumbing, gate refusals
   (`--execute` without env var, no-passphrase, backup-verify failure) are untested
   at the command level.
3. **Lab-provision scripts not in repo** — `proofs.go` cites
   `lab-provision-{pg,dbclones,wg,gitea,appsec,mongo,k8s}.sh` but they live only in
   the VM/runbook. LIVE-VM proofs are not reproducible from a fresh clone.
4. **No CI** — gitea remote exists; branch upstream is gone (`master...origin/master
   [gone]`); nothing runs build/vet/test -race on push.
5. **CLAUDE.md "Where development is" is stale (2026-06-15)** — claims "zero
   rotation drivers exist"; reality is 22 drivers + wired execute spine.
6. **Phase B not wired** — adapters exist but pw-plan→pw-commit flow incomplete.
7. **No scheduled turnover** — `status` knows what's stale; nothing acts on it
   headlessly yet (roadmap M3).
8. **npm caveat** — real registry token creation requires the account password;
   driver can never leave MOCK-ONLY without a design decision.