feat(vault): M4 write-path increment (remove + generate) + first green CI

## M4 write-path increment

- `vault generate` — pure-local password generator (`vault-core::generate`):
  `GenerateOptions` (length + per-class toggles) → `Zeroizing<String>`, OS
  `getrandom` with 64-bit rejection sampling (no modulo bias), one-per-enabled-
  class seed then Fisher–Yates shuffle. CLI: `vault generate [--length N]
  [--symbols] [--no-lowercase] [--no-uppercase] [--no-digits] [--json]`.
- `vault remove` — soft-delete via `DELETE /api/ciphers/{id}`, dropped from the
  in-memory cache. Selector matches `Cipher.id` exactly first, else a
  case-insensitive decrypted-name match; multiple name matches refuse with
  `IpcError::AmbiguousItem { name, ids }` (CLI exit 10). Non-TTY stdin requires
  `--force`. New `Response::Removed { id, name }`; `vault-agent::Vault` now owns
  the authenticated `BitwardenClient` (retiring the dead `access_token` field).

(add / edit remain pending for the rest of M4.)

## First green CI (M0–M3 had been red on every push)

Four jobs were failing independently of behaviour; all four now pass locally
against `cargo {fmt,clippy -D warnings,test} --workspace`, `cargo deny`, and the
`--version` gate:

- clippy: resolved workspace-wide pedantic + nursery + restriction debt that had
  never been seen (clippy never completed locally). `# Errors`/`# Panics` docs,
  `const fn`, `#[must_use]`, let-chains, `map_or`/`sort_by_key`, derived
  `Default`, `Send`/`Sync` bounds on the transport generics, and justified
  `#[allow]`s on the infallible HMAC/RNG `expect`s and the civil-calendar casts.
- `vault --version`: now emits the §13.2 block via `long_version` (clap's
  `after_help` only shows on `--help`). Mirrored in `vault-agent`.
- rustfmt: `cargo fmt --all`.

Policy decisions (called out, not slipped in):
- deny.toml: allow `CDLA-Permissive-2.0` — webpki-roots ≥ 1.0 ships Mozilla's CA
  bundle under it; a permissive *data* licence, GPL-compatible, no copyleft on
  the linking program.
- The eight `vault-*` crates are `publish = false` (internal app crates, never
  released to crates.io) + `allow-wildcard-paths = true`, so intra-workspace
  `path` deps stop tripping the wildcard ban.
- clippy.toml: `unwrap`/`expect`/`panic` permitted in tests only.

Note: `.cargo/config.toml` (local Arch `-flto=auto` workaround) is deliberately
left untracked — its `force`d CFLAGS would break the macOS CI runner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: UnbreakableMJ

.gitignore

@@ -4,6 +4,13 @@
 /target/
 **/*.rs.bk
 *.pdb
+/rust_out
+
+# Local-only cargo config. On Arch, /etc/makepkg.conf leaks `-flto=auto` into
+# CFLAGS, which breaks ring's C build under ld.lld; .cargo/config.toml overrides
+# CFLAGS to fix it. Kept untracked — its force'd flags (e.g. -fcf-protection)
+# would break non-Arch CI runners (notably macOS / Apple clang).
+/.cargo/
 
 # Editor / IDE
 .idea/

CHANGELOG.md

@@ -8,8 +8,58 @@ range may break in any release.
 
 ## [Unreleased]
 
+### Fixed
+
+- **CI is green for the first time (M0–M3 had been red on every push).** Four
+  jobs were failing independently of the code's behaviour:
+  - **`clippy -D warnings`** — the workspace lints enable `clippy::pedantic` +
+    `clippy::nursery` and deny `unwrap`/`expect`/`panic`, but clippy had never
+    run to completion locally (a stale-artifact issue), so the debt was never
+    seen. Resolved across every crate: `# Errors` / `# Panics` doc sections,
+    `const fn`, `#[must_use]`, let-chains for collapsible `if`s, `map_or`,
+    `sort_by_key`, derived `Default`, `Send`/`Sync` bounds on the transport
+    generics (`future_not_send`), and justified `#[allow]`s on the
+    infallible-HMAC/RNG `expect`s and the civil-calendar casts in
+    `vault-agent::unlock`.
+  - **`vault --version`** now actually emits the §13.2 attribution block. clap
+    only surfaces `after_help` on `--help`, so the block was missing from
+    `--version`; it now rides in `long_version` (mirrored in `vault-agent`).
+  - **rustfmt** — `cargo fmt --all` applied.
+  - **cargo-deny** — two policy decisions, called out explicitly: (1) allow
+    `CDLA-Permissive-2.0` (webpki-roots ≥ 1.0 ships Mozilla's CA bundle under
+    it — a permissive *data* licence, GPL-compatible, no copyleft on the
+    linking program); (2) mark the eight `vault-*` crates `publish = false` and
+    set `allow-wildcard-paths = true` so intra-workspace `path` deps stop
+    tripping the wildcard ban. A `clippy.toml` permits `unwrap`/`expect`/`panic`
+    in tests only.
+
 ### Added
 
+- **M4 (slice 2) — `vault remove`.** Soft-deletes a cipher via
+  `DELETE /api/ciphers/{id}` and drops it from the in-memory cache. CLI:
+  `vault remove <selector> [-f|--force] [--json]`. The selector matches
+  `Cipher.id` exactly first, then falls back to a case-insensitive
+  decrypted-name match; if a name resolves to more than one cipher the agent
+  refuses with `AmbiguousItem` (CLI exit 10) and prints the matching ids so
+  the caller can retry with the explicit UUID. Interactive callers must
+  re-type the selector to confirm; non-TTY stdin requires `--force`.
+  `vault-agent::Vault` now owns the authenticated `BitwardenClient`
+  (replacing the dead-code `access_token` field) so future M4 verbs reuse
+  one session. New `IpcError::AmbiguousItem { name, ids }` variant; new
+  `Response::Removed { id, name }`. Three new tests:
+  `resolve_cipher_matches_by_id_then_name`,
+  `resolve_cipher_rejects_ambiguous_name` (agent), and an `#[ignore]`d
+  wiremock test `delete_cipher_sends_authorized_delete` (api) that asserts
+  the `Bearer` header and surfaces 404 as `ServerStatus`.
+- **M4 (slice 1) — `vault generate`.** Pure-local password generator with no
+  agent or server interaction. `vault-core::generate::generate_password`
+  takes a `GenerateOptions` (length + per-class toggles for lowercase,
+  uppercase, digits, symbols) and returns a `Zeroizing<String>`. Sampling
+  uses OS `getrandom` with 64-bit rejection sampling to avoid modulo bias;
+  output is seeded with one character from each enabled class then
+  Fisher–Yates shuffled. CLI verb `vault generate [--length N] [--symbols]
+  [--no-lowercase] [--no-uppercase] [--no-digits] [--json]`. 8 integration
+  tests in `crates/vault-core/tests/generate.rs`.
 - M0 scaffolding: Cargo workspace, eight member crates (`vault-core`,
   `vault-api`, `vault-store`, `vault-agent`, `vault-ipc`, `vault-cli`,
   `vault-tui`, `vault-theme`).

Cargo.toml

@@ -15,6 +15,10 @@ members = [
 
 [workspace.package]
 version = "0.0.1"
+# Internal application crates — distributed as the `vault` / `vault-agent`
+# binaries, never published to crates.io as libraries. Keeps cargo-deny's
+# wildcard check happy with intra-workspace `path` deps (allow-wildcard-paths).
+publish = false
 edition = "2024"
 rust-version = "1.95"
 license = "GPL-3.0-or-later"

clippy.toml

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Clippy configuration for the Vault workspace.
+#
+# The workspace lints (`[workspace.lints]` in Cargo.toml) deny `unwrap_used`,
+# `expect_used`, and `panic` so production code surfaces every failure through
+# the typed error path. Test code is exempt: an `unwrap()`/`expect()`/`panic!`
+# in a `#[test]` is the idiomatic way to assert, and a panic there fails the
+# test rather than a user's session.
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true

crates/vault-agent/Cargo.toml

@@ -4,6 +4,7 @@
 name = "vault-agent"
 description = "Vault long-lived daemon — master-key custody, UDS server"
 version.workspace = true
+publish.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/vault-agent/src/main.rs

@@ -29,10 +29,21 @@ Maintained by Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>
 Copyright (C) 2026 Mohamed Hammad & Spacecraft Software  |  License: GPL-3.0-or-later
 https://Vault.SpacecraftSoftware.org/";
 
+/// `--version` payload — mirrors `vault`'s: clap shows `after_help` only on
+/// `--help`, so the §13.2 attribution block rides in `long_version`.
+const LONG_VERSION: &str = concat!(
+    env!("CARGO_PKG_VERSION"),
+    "\n",
+    "Maintained by Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>\n",
+    "Copyright (C) 2026 Mohamed Hammad & Spacecraft Software  |  License: GPL-3.0-or-later\n",
+    "https://Vault.SpacecraftSoftware.org/",
+);
+
 #[derive(Parser, Debug)]
 #[command(
     name = "vault-agent",
     version = env!("CARGO_PKG_VERSION"),
+    long_version = LONG_VERSION,
     about = "Vault agent — holds the unwrapped user key behind a Unix socket",
     after_help = ATTRIBUTION,
     after_long_help = ATTRIBUTION,

crates/vault-agent/src/server.rs

@@ -71,11 +71,7 @@ async fn handle_conn(stream: UnixStream, state: Arc<Mutex<AgentState>>) {
 
 async fn dispatch(req: Request, state: &Arc<Mutex<AgentState>>) -> Response {
     match req {
-        Request::Ping => {
-            let s = state.lock().await;
-            Response::Status(s.status_snapshot())
-        }
-        Request::Status => {
+        Request::Ping | Request::Status => {
             let s = state.lock().await;
             Response::Status(s.status_snapshot())
         }
@@ -84,10 +80,10 @@ async fn dispatch(req: Request, state: &Arc<Mutex<AgentState>>) -> Response {
             email,
             password,
         } => {
+            // Wrap the password so it is zeroised on drop no matter how
+            // perform_unlock fares; deref coercion hands it to the API as &[u8].
+            let password = zeroize::Zeroizing::new(password);
             let unlock_res = perform_unlock(&server, &email, &password).await;
-            // Wipe password no matter how perform_unlock fared.
-            let mut password = password;
-            password.iter_mut().for_each(|b| *b = 0);
             match unlock_res {
                 Ok(vault) => {
                     let mut s = state.lock().await;
@@ -108,16 +104,18 @@ async fn dispatch(req: Request, state: &Arc<Mutex<AgentState>>) -> Response {
             // M3 keeps Sync minimal: the agent already pulled /sync during
             // unlock. A standalone re-sync lands in M4 when the cache reload
             // path is split out of the unlock flow.
-            let s = state.lock().await;
-            if !s.is_unlocked() {
-                return Response::Error(IpcError::Locked);
+            let unlocked = state.lock().await.is_unlocked();
+            if unlocked {
+                Response::Ok
+            } else {
+                Response::Error(IpcError::Locked)
             }
-            Response::Ok
         }
         Request::List => {
             let mut s = state.lock().await;
             let res = s.list_entries();
             s.touch();
+            drop(s);
             match res {
                 Ok(items) => Response::List(items),
                 Err(e) => Response::Error(e),
@@ -128,11 +126,25 @@ async fn dispatch(req: Request, state: &Arc<Mutex<AgentState>>) -> Response {
             let f = field.unwrap_or_default();
             let res = s.get_item(&name, f);
             s.touch();
+            drop(s);
             match res {
                 Ok(item) => Response::Item(item),
                 Err(e) => Response::Error(e),
             }
         }
+        Request::Remove { selector } => {
+            // Hold the agent mutex across the network call. Vault is
+            // single-user / single-agent, so request concurrency is low and
+            // a coarse lock keeps the cache + server in lock-step.
+            let mut s = state.lock().await;
+            let res = s.remove_cipher(&selector).await;
+            s.touch();
+            drop(s);
+            match res {
+                Ok(removed) => Response::Removed(removed),
+                Err(e) => Response::Error(e),
+            }
+        }
         Request::Quit => {
             let mut s = state.lock().await;
             s.lock();