Add credential sharing openspec

docs/cli.md

@@ -10,19 +10,9 @@ Aliases:
 
 ```bash
 logicsrc
-commandboard
-cb
 ```
 
-`logicsrc` is the canonical standards CLI. `commandboard` and `cb` remain product/client aliases for CommandBoard.run-compatible workflows.
-
-Product CLIs may embed LogicSRC as a sub-command:
-
-```bash
-sh1pt logicsrc <resource> <action> [options]
-sh1pt logicsrc --openspec <resource> <action> [options]
-sh1pt logicsrc --openspec-only <resource> <action> [options]
-```
+`logicsrc` is the canonical standards CLI.
 
 `--openspec` enables OpenSpec.dev-compatible repo-local planning conventions where supported, such as specs, proposals, implementation tasks, and requirement deltas.
 
@@ -41,6 +31,7 @@ task
 wallet
 events
 agentswarm
+credentials
 openspec
 plugins
 tui
@@ -53,7 +44,6 @@ AgentSwarm master-agent command:
 ```bash
 logicsrc agentswarm --yolo --repo profullstack/logicsrc --agents reproduce,patch,review
 logicsrc --openspec agentswarm --yolo --repo profullstack/logicsrc
-sh1pt logicsrc --openspec-only agentswarm --yolo --repo profullstack/logicsrc
 ```
 
 `agentswarm --yolo` opens the master agent flow. The master agent coordinates slave agents for scoped work such as reproduction, patching, review, documentation, and release evidence.
@@ -66,6 +56,16 @@ logicsrc openspec export --out logicsrc-openspec-summary.md
 logicsrc openspec change --id add-agent-policy --capability agents
 ```
 
+Credential sharing commands:
+
+```bash
+logicsrc credentials providers
+logicsrc credentials plan --from env --to railway
+logicsrc credentials plan --from doppler --to github-secrets
+```
+
+Credential sharing is provider-neutral. External tools can consume LogicSRC credential contracts, but LogicSRC commands do not call proprietary product CLIs.
+
 When `--openspec` is enabled, AgentSwarm writes OpenSpec.dev-style files under `openspec/changes/<change-id>/`.
 
 Machine-readable output should be available anywhere data is returned:

docs/credential-sharing.md

@@ -0,0 +1,114 @@
+# Credential Sharing OpenSpec
+
+Status: coming soon
+
+Slug: `credential-sharing`
+
+Credential Sharing is a LogicSRC OpenSpec for portable, auditable secret synchronization across local files and infrastructure providers. It is intended to replace closed, proprietary credential-sharing workflows with a provider-neutral contract.
+
+LogicSRC defines the open objects, CLI commands, SDK calls, TUI states, PWA states, provider adapter capabilities, and audit records. External products may consume this contract, but LogicSRC does not call out to product-specific commands.
+
+## First Providers
+
+```txt
+env
+doppler
+railway
+github-secrets
+```
+
+- `.env`: read, diff, redact, and write local environment files.
+- Doppler: sync project/config scoped secrets.
+- Railway: sync service variables.
+- GitHub Secrets: sync repository, organization, and environment secrets.
+
+## Core Objects
+
+```txt
+credential_provider
+credential_source
+credential_target
+credential_key
+credential_fingerprint
+credential_policy
+credential_diff
+credential_sync_plan
+credential_sync_run
+credential_approval
+credential_rollback
+credential_audit_event
+```
+
+## CLI Spec
+
+Command namespace:
+
+```bash
+logicsrc credentials <command>
+```
+
+Required commands:
+
+```txt
+providers
+inspect
+plan
+diff
+approve
+sync
+rollback
+audit
+export
+```
+
+Examples:
+
+```bash
+logicsrc credentials providers
+logicsrc credentials plan --from env --to railway
+logicsrc credentials plan --from doppler --to github-secrets
+logicsrc credentials diff --from env --to doppler --redact
+logicsrc credentials sync --plan cred_plan_123 --approve
+logicsrc credentials audit --run cred_run_123 --format markdown
+```
+
+## Security Rules
+
+- Raw secret values must never be printed by default.
+- Audit logs should store key names, targets, timestamps, actor identity, and value fingerprints, not raw values.
+- Every write operation should support dry-run mode.
+- Provider adapters must declare read/write capabilities before a plan is generated.
+- Destructive changes require explicit approval.
+- Rollbacks must be represented as new sync plans rather than hidden mutation history.
+
+## SDK Spec
+
+All SDKs should expose the same conceptual API:
+
+```txt
+listCredentialProviders()
+inspectCredentialSource(source)
+createCredentialSyncPlan(input)
+diffCredentialTargets(planId)
+approveCredentialSync(planId, approval)
+runCredentialSync(planId)
+rollbackCredentialSync(runId)
+exportCredentialAudit(runId)
+```
+
+## Provider Adapter Contract
+
+Provider adapters implement the LogicSRC credential provider contract:
+
+```txt
+provider.id
+provider.capabilities
+provider.auth_requirements
+provider.inspect()
+provider.diff()
+provider.write()
+provider.rollback()
+provider.audit()
+```
+
+The adapter boundary lets tools such as a PWA, TUI, CI workflow, or external CLI consume the same open standard without making LogicSRC depend on any specific product.

docs/openapi.yaml

@@ -1,10 +1,10 @@
 openapi: 3.1.0
 info:
-  title: CommandBoard.run LogicSRC API
+  title: LogicSRC Reference API
   version: 0.1.0
-  description: REST API draft for the CommandBoard.run reference implementation.
+  description: REST API draft for LogicSRC open standards reference implementations.
 servers:
-  - url: https://commandboard.run
+  - url: https://logicsrc.com
 paths:
   /api/boards:
     get:
@@ -31,18 +31,18 @@ paths:
       responses:
         "200":
           description: Plugins returned
-  /api/plugins/sh1pt/projects:
+  /api/credentials/providers:
     get:
-      summary: List or sync sh1pt projects
+      summary: List supported credential provider targets
       responses:
         "200":
-          description: sh1pt projects returned
-  /api/plugins/sh1pt/actions/publish:
+          description: Credential providers returned
+  /api/credentials/plans:
     post:
-      summary: Publish a sh1pt action into CommandBoard.run
+      summary: Create a redacted credential sync plan
       responses:
-        "202":
-          description: sh1pt action accepted
+        "201":
+          description: Credential sync plan created
   /api/schemas:
     get:
       summary: List supported LogicSRC schema kinds

docs/openspec-comparison.md

@@ -11,10 +11,10 @@ The projects can be complementary. LogicSRC should support an `--openspec` compa
 | Primary scope | Open coordination standards for humans, AI agents, plugins, payments, hosted products, and reference implementations. | Lightweight spec-driven planning framework for code changes and agent work. |
 | Main artifact shape | Versioned schemas, plugin manifests, event contracts, task/agent/run documents, SDK contracts, MCP resources, CLI/TUI/PWA/API surfaces. | Repo-local specs, proposals, design docs, tasks, and spec deltas. |
 | Agent relationship | Agent profiles, runs, audit logs, model routing, AgentSwarm orchestration, and provider-neutral execution records. | Planning layer that gives coding agents persistent requirements and change context. |
-| CLI direction | `logicsrc`, plus compatible product aliases and `sh1pt logicsrc ...`. | `@fission-ai/openspec` CLI and slash-command integrations with coding tools. |
+| CLI direction | `logicsrc` as the canonical OpenStandards CLI. | `@fission-ai/openspec` CLI and slash-command integrations with coding tools. |
 | MCP | LogicSRC has a standards MCP server and should expose resources, tools, and prompts. | Site states "No MCP" as a product trait. |
 | SDK/API | Planned Rust, Bun, Node, Python, curl, and PWA surfaces with matching contracts. | Focus appears to be repo workflow and agent planning artifacts rather than a cross-language SDK/API standard. |
-| Plugins | Plugin manifest standard plus CoinPay, uGig, sh1pt, AgentByte, and future integration specs. | Integrates with many coding agents and editors; plugin-contract scope is not the main positioning. |
+| Plugins | Plugin manifest standard plus CoinPay, uGig, AgentByte, Credential Sharing, and future integration specs. | Integrates with many coding agents and editors; plugin-contract scope is not the main positioning. |
 | Compatibility idea | `logicsrc --openspec` reads/writes OpenSpec.dev-style specs/proposals/tasks where useful. | Can remain the lightweight planning layer inside repos. |
 
 ## CLI Flags
@@ -24,7 +24,6 @@ logicsrc --openspec agentswarm --yolo --repo profullstack/logicsrc
 logicsrc openspec import
 logicsrc openspec export --out logicsrc-openspec-summary.md
 logicsrc --openspec-only task validate ./task.yaml
-sh1pt logicsrc --openspec agentswarm --yolo --repo profullstack/logicsrc
 ```
 
 - `--openspec` enables OpenSpec.dev-compatible repo-local planning conventions where supported.

docs/plugins.md

@@ -6,11 +6,12 @@ Default plugins:
 
 - CoinPay: DID auth, wallet, payment, escrow, refunds, tips, payment webhooks, and payment reputation.
 - uGig: job import, gig publishing, candidate/agent linking, bid sync, marketplace publishing, and reputation sync.
-- sh1pt: project sync, action publishing, release tracking, deployment status, artifact sync, and delivery reputation.
+- Credential Sharing: provider-neutral secret sync plans, approvals, rollbacks, and audit events.
 
 Coming soon plugin specs:
 
 - AgentByte: candidate, contractor, and agent capability screening for AI-era workflows. See `docs/agent-screening.md`.
+- Credential Sharing: replacement architecture for .env, Doppler, Railway variables, GitHub Secrets, and future providers. See `docs/credential-sharing.md`.
 
 Runtime requirements:
 
@@ -25,21 +26,17 @@ Runtime requirements:
 
 Manifest shape is defined by `packages/schemas/schemas/logicsrc-plugin.schema.json`.
 
-## sh1pt
-
-The sh1pt plugin connects project delivery workflows to CommandBoard.run boards and LogicSRC tasks. Its default board is `/projects/sh1pt`.
+## Credential Sharing
 
 Capabilities:
 
 ```txt
-projects.sync
-actions.import
-actions.publish
-tasks.create_from_action
-releases.sync
-deployments.create
-deployments.status
-artifacts.sync
-webhook.delivery_status
-reputation.delivery_event
+credentials.providers
+credentials.inspect
+credentials.diff
+credentials.plan
+credentials.approve
+credentials.sync
+credentials.rollback
+credentials.audit
 ```

docs/positioning.md

@@ -18,6 +18,6 @@ Avoid using "LogicSRC Foundation" unless Profullstack creates a separate legal f
 
 LogicSRC defines the common language and primitives: identity, boards, posts, tasks, bounties, agents, agent runs, permissions, payments, escrow, reputation, events, webhooks, CLI commands, SDK contracts, MCP servers, PWA states, curl/API surfaces, and schemas.
 
-CommandBoard.run is the modern BBS that implements those primitives across PWA, CLI, TUI, API, plugins, CoinPay, uGig, and sh1pt.
+CommandBoard.run is one reference product that implements those primitives across PWA, CLI, TUI, API, plugins, CoinPay, and uGig.
 
-sh1pt is a separate Profullstack product CLI that can host LogicSRC as `sh1pt logicsrc ...`. That path is for users who want sh1pt delivery automation while restricting a workflow to OpenSpec contracts from LogicSRC.
+External products can consume LogicSRC contracts, but LogicSRC remains the open standards layer and should not depend on product-specific command paths.

docs/roadmap.md

@@ -6,14 +6,14 @@
 4. Add plugin-core package.
 5. Add CoinPay plugin.
 6. Add uGig plugin.
-7. Add sh1pt plugin.
+7. Add Credential Sharing OpenSpec.
 8. Add CommandBoard.run API.
 9. Add auth and DID connection.
 10. Add boards and posts.
 11. Add task schema validation.
 12. Add CoinPay escrow integration.
 13. Add uGig jobs/gigs integration.
-14. Add sh1pt projects/actions integration.
+14. Add credential provider adapters for .env, Doppler, Railway variables, and GitHub Secrets.
 15. Add `logicsrc` CLI.
 16. Add installer script.
 17. Add CLI update/upgrade.
@@ -26,6 +26,6 @@
 24. Add plugin status UI.
 25. Add SDK contracts for Rust, Bun, Node, Python, and curl.
 26. Add MCP server contracts.
-27. Add `sh1pt logicsrc ...` OpenSpec-only integration.
+27. Add credential sync audit exports.
 28. Add docs.
 29. Tag v1.0.0.