(CODUX-223) Provision secure local credential key custody

[numnx]

🧩 Task: Provision secure local credential key custody

Automated task PR opened by Code UX for T01.

📋 Summary

Sprint: Sprint 223 · Complete automation credential management · Task: T01

Deliver a production-ready, write-only Automation Credentials experience with automatic secure local key custody, fail-closed production behavior, first-class Settings management, policy-aware node-flow and custom-dashboard credential-ID bindings, complete security coverage, and synchronized documentation.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-13 21:06:45 UTC
Finished	2026-07-13 21:11:57 UTC
Duration	5m 13s

📊 Token Usage

Metric	Value
Input tokens	82,566
Cached input tokens	1,764,608
Output tokens	9,245
Total tokens	1,856,419
Invocations	2
Tool calls	22
Active time	11m 35s

Included usage estimate (subscription/local login): $1.57

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Add durable automatic root-key custody for the normal local dashboard runtime without weakening Electron, headless, server, or explicitly configured key-provider security.

## Scope
- Create `src/infrastructure/security/local-file-key-provider.ts`
- Create `src/services/credentials/key-provider-selection.ts`
- Edit `src/app/dependency-factory/core-factory.ts`
- Verify path construction in `src/shared/config/code-ux-paths.ts`
- Update sanitized key-provider configuration in `.env.example` if needed
- Extend `tests/backend/services/credential-key-providers.test.ts` and `tests/backend/services/headless-automation-operations.test.ts`

## Implementation Requirements
1. Implement a local-file `KeyProvider` that stores one generated 32-byte root key under a dedicated path inside `~/.code-ux`, never inside a project checkout or SQLite, with a `0700` parent directory and `0600` regular file.
2. Provision atomically with exclusive creation, safely handle concurrent first access, fsync durable state where supported, reject symlinks/non-files/insecure permissions or ownership, clear temporary key buffers, and reuse the identical key after restart.
3. Centralize provider selection with this precedence: Electron process provider, explicit supported environment provider, automatic local-file provider only for non-server local dashboard mode, then the existing mounted/vault/KMS fail-closed behavior for headless, server, authenticated, or remote-management deployments.
4. Reject unknown or insecure provider selections and never silently select local-file custody for `serverMode`, dashboard-disabled headless operation, non-local authentication, or remote credential management.
5. Return actionable metadata-only health reasons and provider identity without exposing the key, encoded key material, secret path contents, or sensitive filesystem details in logs or responses.
6. Cover first provisioning, exact permissions, concurrent initialization, restart durability, corrupt/insecure files, Electron precedence, explicit-provider precedence, and server/headless refusal to auto-provision.

## Constraints
- Preserve `ElectronSafeStorageKeyProvider` and its OS-protected persistence behavior unchanged.
- Do not add plaintext fallback, store root keys in SQLite, or add dependencies.
- Do not auto-repair an existing insecure or malformed key file; fail closed with setup guidance.
- Keep existing mounted-file, Vault, and KMS configuration paths compatible.

## Verification
- Run `pnpm exec vitest run tests/backend/services/credential-key-providers.test.ts tests/backend/services/headless-automation-operations.test.ts`.
- Run `pnpm run lint` and `pnpm run build`.
- Confirm a temporary normal local runtime reports a secure available provider across restart, while headless/server fixtures without explicit custody remain unavailable or not ready.

🌿 Branch Info

Base: feature/CODUX-223-complete-automation-credential-management
Head: task/feature-codux-22-t01-codex-956f5bfc-mrjpgtbu

---

🤖 Generated by Code UX