uBix Vault v0.1.0

First release: the complete MVP core (see docs/DESIGN.md §6). uBix Vault can be initialized, unsealed, and used to store and generate secrets over an authenticated, authorized, audited HTTP API.

Status: working MVP, not yet production-hardened. No external security review or operational hardening yet — for production, use HashiCorp Vault or OpenBao.

Highlights

• Encryption barrier — AES-256-GCM at rest, with the storage path bound into the ciphertext.
• Shamir seal/unseal — in-house, constant-time GF(2⁸), validated against FIPS-197 vectors.
• Token auth + ACL policies — default-deny, scoped tokens; tokens indexed by hash, never stored in the clear.
• KV v2 — versioned secrets with soft-delete / undelete / destroy.
• Transit — encryption-as-a-service; keys never leave the vault and rotate without breaking old ciphertext.
• Dynamic database credentials — short-lived MariaDB users via a DatabasePlugin interface, auto-revoked on lease expiry.
• Audit logging — fail-closed; the client token is HMAC'd, never logged in the clear.
• Server + operator CLI — ubixvault server and ubixvault operator init/unseal/seal-status/seal.

CI runs build, race tests, golangci-lint (incl. gosec), govulncheck, and a MariaDB integration job on every change.

See CHANGELOG.md for the full list and known limitations.