(CODUX-216) Build encrypted credential and key-provider platform

[numnx]

🧩 Task: Build encrypted credential and key-provider platform

Automated task PR opened by Code UX for T02.

📋 Summary

Sprint: Sprint 216 · Nodes Full Integration · Task: T02

Turn the existing project-scoped node-flow foundation and browser-local canvas into a canonical, secure, versioned automation control plane with registry-driven nodes, encrypted credentials, durable execution, governed integrations, isolated custom nodes, agent authoring, dashboard integration, and authenticated headless readiness.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-12 04:12:08 UTC
Finished	2026-07-12 04:27:20 UTC
Duration	15m 12s

📊 Token Usage

Metric	Value
Input tokens	189,466
Cached input tokens	7,760,384
Output tokens	36,496
Total tokens	7,986,346
Invocations	1
Tool calls	77
Active time	14m 45s

Included usage estimate (subscription/local login): $5.92

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Implement the credential control plane consumed by canonical node bindings, with encrypted local storage, key-provider abstractions, scoped access, metadata-only auditing, and safe dashboard management APIs.

## Scope
- New `src/contracts/automation-credential-types.ts`
- New `src/services/credentials/secret-store.ts`, `key-provider.ts`, `credential-broker.ts`, and encryption utilities
- New `src/infrastructure/security/encrypted-sqlite-secret-store.ts`, `electron-safe-storage-key-provider.ts`, `mounted-key-file-provider.ts`, and external Vault/KMS boundary adapters
- New `src/repositories/automation-credential-repository.ts`
- `src/repositories/db/app-db-migrations.ts`
- New `src/server/automation-credential-routes.ts`
- `src/server/dashboard-route-registration.ts`
- `src/app/dependency-factory/core-factory.ts` and `src/app/dependency-factory/dashboard-factory.ts`
- New `dashboard/src/v2/lib/automation-credential-api.ts` and credential-management components
- `tests/backend/`, `tests/dashboard/`, `src/electron/`, and credential documentation under `docs/` and `docs-web/`

## Implementation Requirements
1. Define `SecretStore`, `KeyProvider`, credential schema, scope, status, rotation, and access-event contracts; support project-scoped credentials and explicitly approved global credentials with project allowlists.
2. Implement AES-256-GCM envelope encryption with unique data keys and nonces, authenticated credential and workspace context, wrapped keys, key IDs and versions, tamper detection, plaintext clearing where practical, and fail-closed behavior when key material or secure OS storage is unavailable.
3. Implement encrypted SQLite storage plus Electron safe-storage and mounted-key-file provider boundaries; external Vault/KMS providers must expose typed integration points and clear unavailable/health states rather than silently falling back to plaintext.
4. Add repository tables and indexes for credentials, bindings, access events, and rotations; expose create, bind, test, rotate, revoke, replace, promote, and restrict operations through write-only routes that return configuration metadata but never stored values.
5. Add project ownership checks, capability-aware credential resolution, metadata-only access auditing, crypto and redaction tests, and synchronized canonical/public credential security documentation.

## Constraints
- Never place root encryption keys in SQLite, environment-derived response bodies, logs, MCP payloads, agent context, or run inspection records.
- Preserve existing dashboard authentication and route-registration patterns; keep handlers thin and delegate policy to services.
- Missing, insecure, unavailable, revoked, or cross-project credential backends must fail closed.

## Verification
- Run focused credential repository, service, route, and dashboard tests with `pnpm exec vitest run` against the new test files.
- Verify known AES-GCM behavior, nonce uniqueness, ciphertext/tag tampering, wrong key/AAD rejection, rotation, recovery failure, insecure-provider rejection, and absence of plaintext in persisted rows and logs.
- Run `pnpm run typecheck`, `pnpm run typecheck:dashboard`, `pnpm run build`, and `pnpm run check:docs-web`.
- Confirm every credential API response contains only configured/status/validation metadata and no secret material.

🌿 Branch Info

Base: feature/CODUX-216-nodes-full-integration
Head: task/feature-codux-21-t02-codex-ceffbcac-mrha1mcr

---

🤖 Generated by Code UX