uBix Vault v0.2.0-beta.5

Fifth beta. An internal certificate authority, self-hosted transit auto-unseal, and security hardening.

Added

• PKI secrets engine — generate a self-signed root CA (key never leaves the vault) and issue short-lived, role-constrained leaf certificates. Vault-compatible /v1/pki/*.
• Transit auto-unseal seal — unseal by wrapping the master key via another Vault-compatible Transit engine, so no KEK lives on the host. Seal interface (ADR D-013).

Security

• Internal review pass: 500 responses no longer echo internal error strings; documented env-var handling for seal secrets. Verified no ACL bypass, path-bound AEAD, constant-time recovery checks, fail-closed audit.

Both features are in-house, no new dependency.

Pre-release. Not production-hardened; no external security review. For production, use HashiCorp Vault or OpenBao.

See CHANGELOG.md.