.ctx/HANDOFF.md

# Handoff — notfiles (2026-07-14)

**Branch:** main | **Build:** unknown | **Tests:** unknown

## Items

| ID | P | Status | Title |
|---|---|---|---|
| uncommitted-work | P1 | open | Uncommitted changes (3 files) |

## Log

- 20260606.135918: done=13 running=0 pending=0 blocked=0
- 2026-07-08: hexagonal architecture refactor with adapters and integration tests, notsecrets cleanup, config payload moved to notfiles-config repo
- 2026-04-17: Added notnet crate with YubikeySource and threaded Tailscale into notstrap; design spec complete
- 2026-04-15: Hardened bootstrap and hook-state failure handling, made notfiles FileStore usage real, and fixed copy-drift safety coverage
- 2026-04-15: Pruned completed items from handoff; GitHub issues plus doob are now the source of truth for active work
chore(repo): add git-cliff config, sort deps, add rust-version - Add cliff.toml with GitHub remote wiring, issue link parsers, and clean group names (no sort prefixes) - Add rust-version = "1.87.0" and codegen-units = 1 to workspace - Sort workspace.dependencies alphabetically; add notstrap path entry - Add CLAUDE.md preflight block; reformat workspace table to 100-col - Delete stale brainstorm artifacts and root HANDOFF.md 2026-07-14 10:14:43 -04:00			`# Handoff — notfiles (2026-07-14)`
docs: update handoff 2026-04-17 18:56:22 -04:00
feat(notsecrets): add multi-provider secret resolution system Add a config-driven, strongly-typed secret/env resolution system to notsecrets with 11 provider backends. The system supports explicit key bindings with typed SecretRef enums and a priority chain fallback. Tier 1 providers (implemented): Env, 1Password, dotenvx, SOPS, GSM Tier 2 providers (stubbed): nuenv, direnv, mise, Bitwarden, Vault, dotenvy New types: Provider, ProviderConfig, SecretRef, SecretsConfig, SecretsError, SecretSource, EnumerableSecretSource, SecretResolver Config lives in notsecrets.toml with typed serde deserialization. ISP split: EnumerableSecretSource for backends that support bulk enumeration, SecretSource for single-key lookup only. Includes conformance test suite, 33 new tests (161 workspace total). notstrap EnvInjector migration deferred to follow-up. 2026-06-06 09:49:05 -04:00			`Branch: main \| Build: unknown \| Tests: unknown`
docs: update handoff 2026-04-17 18:56:22 -04:00
			`## Items`

			`\| ID \| P \| Status \| Title \|`
			`\|---\|---\|---\|---\|`
feat(notfiles): hexagonal architecture refactor with adapters, integration tests, and notsecrets cleanup - Extract FileStore port and InMemoryFileStore/FileStoreImpl/Reporter adapters - Add Reporter trait to notcore with TerminalReporter and JsonReporter - Refactor linker, package, status modules to use FileStore port - Add integration test suite with dotfiles fixtures - Add cross-crate integration tests - Remove ssh_rsa identity/recipient (unsupported) - Add rustqual.toml, .sccignore, notfiles.toml config files - Update CLAUDE.md, README.md, AGENTS.md with current architecture 2026-07-08 13:07:42 -04:00			`\| uncommitted-work \| P1 \| open \| Uncommitted changes (3 files) \|`
docs: update handoff 2026-04-17 18:56:22 -04:00
			`## Log`

feat(notfiles): hexagonal architecture refactor with adapters, integration tests, and notsecrets cleanup - Extract FileStore port and InMemoryFileStore/FileStoreImpl/Reporter adapters - Add Reporter trait to notcore with TerminalReporter and JsonReporter - Refactor linker, package, status modules to use FileStore port - Add integration test suite with dotfiles fixtures - Add cross-crate integration tests - Remove ssh_rsa identity/recipient (unsupported) - Add rustqual.toml, .sccignore, notfiles.toml config files - Update CLAUDE.md, README.md, AGENTS.md with current architecture 2026-07-08 13:07:42 -04:00			`- 20260606.135918: done=13 running=0 pending=0 blocked=0`
chore(repo): add git-cliff config, sort deps, add rust-version - Add cliff.toml with GitHub remote wiring, issue link parsers, and clean group names (no sort prefixes) - Add rust-version = "1.87.0" and codegen-units = 1 to workspace - Sort workspace.dependencies alphabetically; add notstrap path entry - Add CLAUDE.md preflight block; reformat workspace table to 100-col - Delete stale brainstorm artifacts and root HANDOFF.md 2026-07-14 10:14:43 -04:00			`- 2026-07-08: hexagonal architecture refactor with adapters and integration tests, notsecrets cleanup, config payload moved to notfiles-config repo`
feat(notsecrets): add multi-provider secret resolution system Add a config-driven, strongly-typed secret/env resolution system to notsecrets with 11 provider backends. The system supports explicit key bindings with typed SecretRef enums and a priority chain fallback. Tier 1 providers (implemented): Env, 1Password, dotenvx, SOPS, GSM Tier 2 providers (stubbed): nuenv, direnv, mise, Bitwarden, Vault, dotenvy New types: Provider, ProviderConfig, SecretRef, SecretsConfig, SecretsError, SecretSource, EnumerableSecretSource, SecretResolver Config lives in notsecrets.toml with typed serde deserialization. ISP split: EnumerableSecretSource for backends that support bulk enumeration, SecretSource for single-key lookup only. Includes conformance test suite, 33 new tests (161 workspace total). notstrap EnvInjector migration deferred to follow-up. 2026-06-06 09:49:05 -04:00			`- 2026-04-17: Added notnet crate with YubikeySource and threaded Tailscale into notstrap; design spec complete`
			`- 2026-04-15: Hardened bootstrap and hook-state failure handling, made notfiles FileStore usage real, and fixed copy-drift safety coverage`
docs: update handoff 2026-04-17 18:56:22 -04:00			`- 2026-04-15: Pruned completed items from handoff; GitHub issues plus doob are now the source of truth for active work`