chore: scaffold M0 — workspace, posture files, CI

Stand up the Vault workspace per PRD §9.1 and §12:

- Cargo workspace with 8 member crates (vault-core, vault-api,
  vault-store, vault-agent, vault-ipc, vault-cli, vault-tui,
  vault-theme), edition 2024, resolver 3, MSRV 1.95.
- vault CLI binary: `--version` emits the Spacecraft Software
  Standard §13.2 attribution block (M0 gate).
- Posture files at repo root: README, NOTICE, CONTRIBUTING, LICENSE
  (GPL-3.0-or-later), CREDITS, CHANGELOG. PRD.md authored separately.
- CI: rustfmt, clippy -D warnings, multi-OS build+test, dedicated
  version-gate job that greps for the §13.2 attribution lines, cargo
  audit, and cargo deny.
- Tooling: rust-toolchain.toml (stable), rustfmt.toml, deny.toml.
- .gitignore excludes nested reference repos (cruxpass/, rbw/),
  build artefacts, and AI-assistant artefacts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: UnbreakableMJ

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+
+jobs:
+  fmt:
+    name: rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all -- --check
+
+  clippy:
+    name: clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+  test:
+    name: test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --workspace --all-targets
+      - run: cargo test --workspace --all-targets
+
+  version-gate:
+    name: vault --version emits §13.2 attribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --bin vault --release
+      - name: Verify attribution block
+        run: |
+          out=$(./target/release/vault --version)
+          echo "$out"
+          echo "$out" | grep -q "Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>" \
+            && echo "$out" | grep -q "GPL-3.0-or-later" \
+            && echo "$out" | grep -q "https://Vault.SpacecraftSoftware.org/"
+
+  audit:
+    name: cargo-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: EmbarkStudios/cargo-deny-action@v2

.gitignore

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Rust build artifacts
+/target/
+**/*.rs.bk
+*.pdb
+
+# Editor / IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+
+# AI assistant artifacts — kept local, not published
+Chat.txt
+CLAUDE.md
+AGENTS.md
+GEMINI.md
+.claude/
+.cursor/
+.cursorrules
+.aider*
+
+# Nested reference repositories (out-of-tree third-party projects)
+# Kept on disk for offline reference during development.
+/cruxpass/
+/rbw/
+
+# Local environment overrides
+.env
+.env.*
+!.env.example

CHANGELOG.md

@@ -0,0 +1,20 @@
+<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+
+# Changelog
+
+All notable changes to Vault are documented here. Dates are ISO 8601 UTC per
+the Spacecraft Software Standard §12. Vault is pre-1.0; versions in the `0.x`
+range may break in any release.
+
+## [Unreleased]
+
+### Added
+
+- M0 scaffolding: Cargo workspace, eight member crates (`vault-core`,
+  `vault-api`, `vault-store`, `vault-agent`, `vault-ipc`, `vault-cli`,
+  `vault-tui`, `vault-theme`).
+- `vault --version` emits the Standard §13.2 attribution block.
+- Posture files at repo root: `README.md`, `NOTICE.md`, `CONTRIBUTING.md`,
+  `LICENSE`, `CREDITS.md`, `CHANGELOG.md`.
+- `PRD.md` — full product requirements document.
+- CI configuration: `fmt`, `clippy -D warnings`, `cargo audit`, `cargo deny`.

CONTRIBUTING.md

@@ -0,0 +1,115 @@
+<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+
+# Contributing to Vault
+
+Thank you for your interest. Please read this document before opening an
+issue or pull request — it sets honest expectations for both sides so no
+one's time is wasted.
+
+## Project Stance
+
+Vault is a subproject of **Spacecraft Software**, a personal hobby project. It
+is shaped around the maintainer's own use case and developed at hobby pace.
+
+This is **not** a community-driven project, but external input is welcome
+and appreciated within the bounds set out below.
+
+## What Is Welcome
+
+- **Bug reports** — clear, reproducible, with environment details (OS, kernel,
+  Rust toolchain version, shell, server type — bitwarden.com vs Vaultwarden,
+  relevant config). For security-sensitive bugs see *Reporting Security Issues*
+  below.
+- **Suggestions** — features, refactors, naming proposals (must conform to
+  Spacecraft Software Standard §2 — aerospace / sci-fi / AI naming), design
+  feedback.
+- **Pull requests** — small, focused, and aligned with the Spacecraft Software
+  Standard and Vault's PRD.
+- **Documentation fixes** — typos, inaccuracies, broken links, clarifications,
+  translations.
+- **Test coverage improvements** — almost always merge-worthy.
+
+## What Is Not Guaranteed
+
+- **PR acceptance.** Direction, scope, and quality bar are set by the
+  maintainer alone. A submitted contribution is not a guaranteed merge, even
+  if it is correct, well-written, and passes CI. If a PR is not accepted, that
+  is a judgment of fit, not of the work.
+- **Response time.** This is a hobby project. Expect responses on the order of
+  days to weeks, not hours.
+- **Roadmap influence.** Suggestions may inform direction but do not override
+  the maintainer's plans documented in [`PRD.md`](./PRD.md).
+- **API stability for in-progress work.** Pre-1.0 versions may break in any
+  release.
+
+## Before Opening a PR
+
+1. **Open an issue first** for non-trivial changes. Discuss the design before
+   writing code.
+2. **Read the Spacecraft Software Standard** and the Vault [`PRD.md`](./PRD.md).
+   Memory safety → performance → hardened security, in that order. Rust where
+   viable. POSIX-compliant CLI. GPL-3.0-or-later with SPDX headers on every
+   source file.
+3. **Match the CLI Standard** (SFRS v1.0.0) for anything touching `vault-cli`.
+4. **Run the full test suite locally.** PRs that don't pass CI will not be
+   reviewed.
+5. **Use the project's preferred toolchain.** Format with `rustfmt`, lint with
+   `clippy -- -D warnings`, and run `cargo audit` for any added dependency.
+6. **Sign-off your commits** (`git commit -s`) under the
+   [Developer Certificate of Origin](https://developercertificate.org/).
+7. **Cryptographically sign your commits** — Spacecraft Software Standard §6.3
+   requires every commit to a Spacecraft Software remote to be signed and show
+   "Verified" on GitHub. Ed25519 SSH signing is the current default.
+
+## Security-Sensitive Areas
+
+Vault handles credential material. Extra care is expected in:
+
+- Anything touching the master key, KDF, or EncString parsing (`vault-core`).
+- The agent's IPC boundary (`vault-ipc`, `vault-agent`).
+- Clipboard handling.
+- Network code (`vault-api`).
+
+Changes in these areas should include unit tests; non-trivial changes should
+include integration tests and, where applicable, fuzz harness updates.
+
+## Commit Style
+
+- Conventional Commits prefix (`feat:`, `fix:`, `docs:`, `refactor:`,
+  `test:`, `chore:`, `perf:`, `build:`, `ci:`).
+- Subject ≤ 72 characters, imperative mood ("add" not "added").
+- Body wrapped at 72 columns; explain *why*, not just *what*.
+- Reference issues by number (`Closes #42`).
+
+## Forking
+
+If your needs diverge from the maintainer's, or you want to take Vault in a
+different direction, **fork it**. That is exactly what GPL-3.0-or-later is
+for. The only constraints are those imposed by the license itself: keep the
+source open and under a compatible license, preserve copyright notices, and
+pass the same freedoms downstream.
+
+## Reporting Security Issues
+
+For security-sensitive bugs, do **not** open a public issue. Email
+&lt;Mohamed.Hammad@SpacecraftSoftware.org&gt; with details. PGP key available on
+request.
+
+A coordinated-disclosure window of 90 days from acknowledgment is the default;
+this can be shortened or lengthened by mutual agreement.
+
+## License of Contributions
+
+By submitting a contribution, you agree that it will be licensed under
+**GPL-3.0-or-later**, the same terms as the project. Contributions that cannot
+be licensed under GPL-3.0-or-later cannot be accepted.
+
+You retain copyright in your contributions; no CLA is required.
+
+---
+
+**Maintainer:** Mohamed Hammad &lt;Mohamed.Hammad@SpacecraftSoftware.org&gt;
+**License:** GPL-3.0-or-later
+**Website:** <https://Vault.SpacecraftSoftware.org/>
+
+*--- Forged in Spacecraft Software ---*

CREDITS.md

@@ -0,0 +1,67 @@
+<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+
+# CREDITS
+
+Vault stands on substantial third-party work. This file is the inbound
+counterpart to the Spacecraft Software Standard §13.2 outbound attribution
+block: §13.2 tells consumers who maintains Vault; this document tells
+consumers whose work Vault stands on. See Standard §13.3.
+
+Routine package-manager dependencies whose `LICENSE` files are surfaced
+mechanically via Cargo are **not** listed here; their license metadata travels
+with the binary. Only works whose ideas or implementation form a substantial
+conceptual basis for Vault appear below.
+
+## Bitwarden — protocol and specification
+
+| Field      | Value                                                                  |
+| ---------- | ---------------------------------------------------------------------- |
+| Name       | Bitwarden                                                              |
+| Author(s)  | Bitwarden, Inc.                                                        |
+| License    | Bitwarden's clients are mostly GPL-3.0; the official Rust SDK includes AGPL-3.0 and Business Source License components. Vault does **not** link or vendor the official SDK. |
+| Source URL | <https://bitwarden.com/help/bitwarden-security-white-paper/>           |
+| Scope      | The Bitwarden protocol — REST endpoints, identity flow, EncString format, KDF parameters — that Vault speaks. Re-implemented from the public security whitepaper and protocol documentation. |
+
+## rbw — CLI shape and reference behaviour
+
+| Field      | Value                                                                  |
+| ---------- | ---------------------------------------------------------------------- |
+| Name       | rbw                                                                    |
+| Author(s)  | Daniel Frank and contributors                                          |
+| License    | MIT                                                                    |
+| Source URL | <https://github.com/doy/rbw>                                           |
+| Scope      | Vault's CLI verb set, agent-process design, and several integration choices were studied from rbw. rbw's MIT license permits reading and re-implementing; no rbw source code is vendored or linked. |
+
+## cruxpass — TUI layout and flow
+
+| Field      | Value                                                                  |
+| ---------- | ---------------------------------------------------------------------- |
+| Name       | cruxpass                                                               |
+| Author(s)  | AryanpurTech                                                           |
+| License    | Reference repository — see upstream                                    |
+| Source URL | <https://github.com/AryanpurTech/cruxpass>                             |
+| Scope      | Vault's TUI three-pane layout, modal flows, and keyboard ergonomics are modelled on cruxpass's interaction design. No source is vendored. |
+
+## ratatui — terminal UI framework
+
+| Field      | Value                                                                  |
+| ---------- | ---------------------------------------------------------------------- |
+| Name       | ratatui                                                                |
+| Author(s)  | The Ratatui Developers                                                 |
+| License    | MIT                                                                    |
+| Source URL | <https://github.com/ratatui-org/ratatui>                               |
+| Scope      | Used as the rendering substrate for `vault-tui`. Listed here because the TUI's structure is shaped by ratatui's widget and layout primitives, beyond routine dependency use. |
+
+## The Spacecraft Software Standard
+
+| Field      | Value                                                                  |
+| ---------- | ---------------------------------------------------------------------- |
+| Name       | The Spacecraft Software Standard                                       |
+| Author(s)  | Mohamed Hammad & Spacecraft Software                                   |
+| License    | GPL-3.0-or-later                                                       |
+| Source URL | <https://Standard.SpacecraftSoftware.org/>                             |
+| Scope      | Vault conforms to v1.12 of the Standard for naming, licensing, posture, attribution, signed commits, and dates/times.                                |
+
+---
+
+*--- Forged in Spacecraft Software ---*