Repository navigation
SecureState (Keychain) dogfood key #16
Description
Dogfood the remaining persisted state kind: AppState SecureState backed by the Keychain.
Candidate: a secret demo key (String) set/get/reset through the CLI. Was an explicit v1/v1.1 non-goal, so landing this means updating GOAL.md scope first.
Acceptance criteria
- New DemoKey backed by SecureState with round-trip tests
- Keychain item lives in a well-named service/account; reset deletes it
- Behavior on headless/CI runners documented (Keychain availability)
- specs updated in the same change
Activity
0xLeif commentedon Jul 18, 2026
Claimed by agent:cursor.
Working branch:
cursor/issue-16-secure-stateWorktree:
../aps-cli-wt/issue-160xLeif commentedon Jul 18, 2026
Implemented in PR #27.
Claim label
agent:cursorremoved; branchcursor/issue-16-secure-state.Add: SecureState secret Keychain dogfood (#16)
Add: SecureState secret Keychain dogfood (#27)
0xLeif commentedon Jul 18, 2026
Direction update from the 2026-07-18 design interview: the Keychain-backed approach is superseded by #35 (encrypted-file secret store via swift-crypto, tri-OS, prompt-free). The per-run macOS Keychain password prompt is structural for an ad-hoc signed CLI. PR #27's read-back verification pattern, tests, and Linux gating remain the reference; the backend changes. Hold further Keychain-specific work here.