docs: record unsigned credential broker decision - #171
Merged
Conversation
Owner call for #154: implement the local Keychain/Secret Service tier with per-use user presence, durable normal profiles, and no silent fill. Apple Developer membership is not a prerequisite. Numbered 24 because 22 and 23 are claimed by the in-review allowlist and upload PRs.
This was referenced Sep 11, 2026
This was referenced Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Records architecture decision 24 for #154.
We are not buying Apple Developer membership for a password manager. Implement the local/community tier: Keychain on macOS, Secret Service or KWallet on Linux, Touch ID or account password on every saved-credential use. Agent-facing protocol speaks aliases and challenge IDs only. Direct
fillstays for test passwords. Default once the vault exists is aliases only.Durable normal-profile cookies (#155) are in this decision so that work can start without a second ADR. Linux moves the Chromium profile to a private XDG data directory. macOS keeps persistent WKWebView storage and tests it.
#166 unsigned silent fill is out. #158 Settings window is not required for the first cut. #45 notarized releases stay blocked on Apple secrets and are not a vault prerequisite.
Numbered 24 because 22 and 23 are claimed by #170 and #169.
Sarthak, this is the contract for vault work. Review when you can. Implementation order after this merges: #155, then #156, then #157.
Closes #154