Development record
abcd-keeps-every-external-credential-the-same-way-one
specclosedspc-2609221017544877
Summary
The design record for itd-2609221017023290: the credential store, its three homes, the walkthrough and the single reader (adr-2609221017021499).
Scope
- The package
internal/core/credential:Resolve,Set, the three home implementations (externalresolves an environment variable or reads a named field of a named tool's configuration file;abcdreads and writes~/.abcd/credentials.jsonat 0600 through the atomic writer;keychainshells to the platform's keychain command on macOS and the secret-service tool on Linux, the configuration holding the name) (criteria 1, 3). - The walkthrough as a function itd-63's mode calls with the service's explanation and verification call; the CLI asks on the terminal, the plugin page through the host's question tool (criterion 2).
- The scanner on the write path; a tracked-path write refused (criterion 3).
- The readers switched to
Resolve; a test greps adapters for direct environment or file reads of secret-shaped names (criterion 4). - The record names only names (criterion 5).
Out of scope
- Rotation; sharing; the host's own credentials.
Approach
The API adapter and the site setup land after this or in the same cut, reading through it from the first commit; the walkthrough is itd-63's mode with a credential step, not a second wizard.
Footprint
- packages: internal/core/credential, internal/core/ahoy, internal/adapter/*
- tests: each home over fixtures; the refusal on an unset name; the tracked-path refusal; the reader grep; the record
How the criteria are satisfied
| Criterion | Where |
|---|---|
| 1 unset refuses, no call | scope 1, 3 |
| 2 walkthrough with three homes | scope 2 |
| 3 no value in tree or harness; scanned | scope 3 |
| 4 one reader | scope 4 |
| 5 names only in the record | scope 5 |
Frontmatter
| id | spc-2609221017544877 |
|---|---|
| type | spec |
| lifecycle | closed |
.abcd/development/specs/closed/spc-2609221017544877-abcd-keeps-every-external-credential-the.md
open on GitHub ↗ · commit history ↗
References1
- itd-2609221017023290abcd keeps every external credential the same wayimplements
mentions3
- adr-2609221017021499Every external credential abcd holds is named in configuration and kept in one store the person chose; never the harness, never the repository
- iss-2609290825319136itd-2609221017023290 ac-2 promises a walkthrough that offers the three homes with the keychain recommended in the prose above the choice; its press release says abcd asks the person once per service where the secret should live, and spc-2609221017544877 scope 2 says the CLI asks on the terminal and the plugin page asks through the host's question tool. Delivered, the CLI's abcd ahoy credential <name> explains and lists the homes with a setup command for each and writes nothing, and the choice is a --home flag on a second invocation (internal/surface/cli/ahoy_credential.go newAhoyCredentialCommand); the CLI never asks. Only the plugin page asks, through the host's question tool (commands/ahoy.md, the credential section). A non-interactive CLI is consistent with every other abcd verb and with the value arriving on stdin only, so this may be the right shape, but the spec and the press release say otherwise and no recorded decision says the CLI's ask was dropped. Either the record says the CLI takes the home as a flag, or the walkthrough asks. Fidelity audit verdict: ac-2 MET_WITH_CONCERNS.
- itd-63The Amateur Coder Is Told What Is Being Installed And Why, Not Just Asked To Run A Command