159/S1 — CredentialStore seam + atomic 0600-at-birth writer + golden fixtures

[kateebonner]

Important

Problem

No writer exists for credential files, and the at-rest discipline (ADR 0001: atomic, 0600 at file birth, one seam) has no implementation.

Approach

A storage-seam interface in the fork server's amicode module space with per-connection-type file backends (Company Compute → the frozen cloud-config byte shape; Pasqal → token-only), an atomic tmp-0600-rename writer, and golden fixtures locking the byte shapes. Code lands in the vendored fork (opencode repo).

---

Acceptance Criteria

1. Writing a Company Compute credential produces a file the CLI's remote-config reader parses (fixture-locked shape: base URL trimmed of trailing slashes + token, nothing else).
2. The tmp file's mode is 0600 at creation — asserted at the tmp stage, never via post-rename chmod; the final file is 0600; a pre-existing wrong-permission file is corrected on write.
3. The write is atomic: an injected failure mid-write leaves no partial or corrupt credential file.
4. The Pasqal backend persists only project id + token (+ expiry metadata); a poison test pushes a password-bearing object through the seam and asserts no password can land on disk.
5. The read path tolerates a missing or unparseable file (returns absent, never throws).

Testing Decisions

New unit suite in the fork's test layout (temp-dir + env-override for file paths, per the existing ops-dir override idiom); golden fixture files live beside the module; no network anywhere.

Key Decisions

• Seam surface: read / write / clear per connection type; backends declare their file + schema.
• File-path env overrides are part of the seam (the test seam and the CLI compatibility seam are the same mechanism).

Constraints & Invariants

• The Company Compute file's shape and location are frozen — every existing CLI consumer must parse the written bytes unchanged.
• No credential value ever appears in a log line.

Source

Part of #159 · ADR 0001 (PR #158) · Blocked by: none · Lands in: opencode fork

[kateebonner]

Merged into the fork-side #159 integration branch (opencode repo); 19/19 tests green, purely additive. Consumer contract for #165/#168: credentials.ts in the fork server's amicode module space — readCredential/writeCredential/clearCredential per connection type, env overrides AMICO_CLOUD_FILE / AMICO_PASQAL_FILE, golden fixtures beside the tests. cloud.json byte shape frozen + verified against the CLI reader contract.