(CODUX-223) Document credential custody and binding workflows

[numnx]

🧩 Task: Document credential custody and binding workflows

Automated task PR opened by Code UX for T09.

📋 Summary

Sprint: Sprint 223 · Complete automation credential management · Task: T09

Deliver a production-ready, write-only Automation Credentials experience with automatic secure local key custody, fail-closed production behavior, first-class Settings management, policy-aware node-flow and custom-dashboard credential-ID bindings, complete security coverage, and synchronized documentation.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-13 23:36:35 UTC
Finished	2026-07-13 23:43:50 UTC
Duration	7m 15s

📊 Token Usage

Metric	Value
Input tokens	150,128
Cached input tokens	3,489,792
Output tokens	15,420
Total tokens	3,655,340
Invocations	1
Tool calls	55
Active time	6m 32s

Included usage estimate (subscription/local login): $2.96

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Update the documentation source of truth and published mirror to describe the implemented security model, management UX, and binding workflows accurately.

## Scope
- Edit `docs/operations/credential-security.md` and `docs/operations/server-mode.md`
- Edit `docs/settings/integrations.md`
- Edit `docs/architecture/node-flows.md` and `docs/architecture/node-flow-builtins-and-security.md`
- Edit `docs/dashboard/node-flows.md`
- Edit `docs/architecture/custom-dashboard-foundation.md` and `docs/dashboard/custom-dashboards.md`
- Verify links in `docs/index.md` and `docs/SUMMARY.md`
- Regenerate matching `docs-web/content/docs/*.mdx` pages with the repository sync command

## Implementation Requirements
1. Explain automatic local CLI/dashboard key provisioning, its user-home location class and owner-only custody, restart durability, health states, and the fact that root keys are never stored in SQLite or a repository.
2. Contrast local custody with Electron safeStorage and explicit mounted/Vault/KMS requirements for headless, server, authenticated, and remote-management deployments, including fail-closed setup and recovery guidance.
3. Document the first Integrations catalog entry and the write-only create, metadata update, rotate/replace, test, restrict/promote, and revoke workflows, including what can never be read back.
4. Document node slot kind/capability filtering, canonical graph bindings, optimistic saves, unbinding, review refresh, and publication/runtime denial cases.
5. Record the repository evidence that current `dev` previously had no custom-dashboard slot contract, then describe only the implemented bounded declarations, credential-ID bindings, validation/publication gates, and explicit no-secret build/iframe/MCP boundaries.
6. Include operational troubleshooting for unavailable custody and stale versions without publishing key material, live project names, secret examples, or insecure recovery shortcuts.
7. Synchronize public docs and ensure no obsolete statement still says normal local dashboard users must manually mount a key file.

## Constraints
- Document only behavior delivered by T01 through T08 and do not claim broader provider-secret migration or custom-dashboard secret injection.
- Keep canonical `docs/` authoritative and use `docs-web/`, never `docs-release/`.
- Do not include real project names, keys, tokens, customer identifiers, or unverified validation claims.
- Preserve existing navigation structure unless a missing link is required for the affected pages.

## Verification
- Run `pnpm run sync:docs-web` followed by `pnpm run check:docs-web`.
- Run `pnpm run build` to validate documentation and application references.
- Search canonical and public docs for obsolete mounted-key-only local guidance and confirm all affected pages agree on write-only and no-injection guarantees.

🌿 Branch Info

Base: feature/CODUX-223-complete-automation-credential-management
Head: task/feature-codux-22-t09-codex-e6682df6-mrjv30fj

---

🤖 Generated by Code UX