feat(operational-layer): wire rgtv CLI to vault-broker + daemon management

- vault-broker: add GET /v1/credentials endpoint (sorted hint names, no values);
  fix pre-existing Zeroizing clone bug in redeem handler; remove .json()
  tracing call that required an unset feature flag
- svalinn-cli → rgtv: full rewrite wired to vault-broker HTTP API via ureq;
  commands: get (grant→redeem→sh exec with Zeroizing value), list, status,
  verify, and daemon start/stop/status (PID-file managed via
  ~/.local/state/rgtv/); honest stubs for audit/rotate with clear TODO messages
- Justfile: replace vex-SATELLITE_NAME placeholders with working targets:
  build-broker, build-cli, broker-dev, broker-start, broker-stop,
  broker-status, broker-logs, creds
- STATE.a2ml: bump completion 45→55%, record completed milestones

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -6,7 +6,7 @@
 [metadata]
 project = "reasonably-good-token-vault"
 version = "0.2.0"
-last-updated = "2026-04-11"
+last-updated = "2026-04-12"
 status = "active"
 
 [project-context]
@@ -15,7 +15,7 @@ purpose = """Zero-trust LLM credential broker. Issues opaque one-use grants to
 authenticated agents; agents redeem grants for raw credential values. Raw values
 never appear in agent context, prompts, or logs. Monorepo containing vault-core
 (crypto library), vault-broker (axum HTTP server), ada-cli, and FFI bindings."""
-completion-percentage = 45
+completion-percentage = 55
 
 [position]
 phase = "implementation"
@@ -30,6 +30,9 @@ milestones = [
   { name = "deploy-fly.sh: rgtv phase with token persistence", completion = 100 },
   { name = "Multi-consumer support (multiple hints per broker instance)", completion = 100 },
   { name = "Grant TTL enforcement and expired-grant auto-purge", completion = 100 },
+  { name = "vault-broker GET /v1/credentials endpoint (list hints, no values)", completion = 100 },
+  { name = "rgtv CLI wired to vault-broker HTTP API (get/list/status/verify/daemon)", completion = 100 },
+  { name = "rgtv daemon start/stop/status (PID-file-managed vault-broker process)", completion = 100 },
   { name = "Honeypot endpoint (canary for credential sniffing)", completion = 20 },
   { name = "RGTV Idris2 ABI formal proofs (grant lifecycle invariants)", completion = 0 },
   { name = "Zig FFI layer (C-compatible vault_grant / vault_redeem)", completion = 0 },
@@ -45,6 +48,7 @@ issues = [
   "Containerfile uses debian:bookworm-slim — should migrate to Chainguard base per container policy",
   "RGTV_AGENT_TOKEN in nesy-solver-api is staged but not yet applied (requires deploy)",
   "No audit log yet — grant/redeem events not persisted anywhere",
+  "rgtv audit/rotate subcommands are honest stubs — backend endpoints not yet implemented",
 ]
 
 [critical-next-actions]
@@ -58,6 +62,9 @@ actions = [
 
 [completed-work]
 entries = [
+  { date = "2026-04-12", description = "vault-broker: added GET /v1/credentials endpoint returning sorted hint names with no credential values. Fixed two pre-existing bugs: Zeroizing<String> clone in redeem handler, .json() tracing_subscriber call removed (feature not enabled)." },
+  { date = "2026-04-12", description = "rgtv CLI (svalinn-cli crate renamed): full rewrite wired to vault-broker HTTP API. Commands: get (grant→redeem→exec with Zeroizing value), list (/v1/credentials), status (/health), verify (functional round-trip), daemon start/stop/status (PID-file managed). Binary renamed from svalinn_cli to rgtv. Added ureq+zeroize deps." },
+  { date = "2026-04-12", description = "Justfile: replaced placeholder template targets with working broker/CLI targets (build-broker, build-cli, broker-dev, broker-start, broker-stop, broker-status, broker-logs, creds)." },
   { date = "2026-04-11", description = "vault-broker crate: axum 0.7 HTTP server with /health, POST /v1/grants, POST /v1/grants/:id/redeem. Zeroizing<String> for all credential storage. IPv6 dual-stack bind. UUID v4 grants. Auto-purge of expired grants on each create call." },
   { date = "2026-04-11", description = "vault-broker fly.toml and Containerfile: multi-stage Rust build on debian:bookworm-slim, non-root rgtv user, curl HEALTHCHECK, TCP service on :9100 with /health check and 15s grace period." },
   { date = "2026-04-11", description = "nesy-solver-api RGTV client (rgtv_client.v): two-step grant→redeem protocol, 10s read timeout, falls back to NESY_INGEST_TOKEN env if RGTV_URL unset." },

Justfile

@@ -1,31 +1,84 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# justfile for vex-SATELLITE_NAME
+# justfile for reasonably-good-token-vault
 
 set shell := ["bash", "-uc"]
 
 default:
     @just --list
 
-# Build the project
+# Build vault-broker and rgtv CLI
 build:
-    cargo build --release
+    cargo build --manifest-path vault-broker/Cargo.toml --release
+    cargo build --manifest-path svalinn-cli/Cargo.toml --release
 
-# Run tests
+# Build vault-broker only
+build-broker:
+    cargo build --manifest-path vault-broker/Cargo.toml --release
+
+# Build rgtv CLI only
+build-cli:
+    cargo build --manifest-path svalinn-cli/Cargo.toml --release
+
+# Build vault-core crypto library
+build-core:
+    cargo build --manifest-path vault-core/Cargo.toml --release
+
+# Run tests for all Rust crates
 test:
-    cargo test
+    cargo test --manifest-path vault-broker/Cargo.toml
+    cargo test --manifest-path svalinn-cli/Cargo.toml
+    cargo test --manifest-path vault-core/Cargo.toml
 
-# Run checks (clippy + fmt)
+# Run clippy + fmt check for all Rust crates
 check:
-    cargo fmt --check
-    cargo clippy -- -D warnings
+    cargo fmt --manifest-path vault-broker/Cargo.toml --check
+    cargo clippy --manifest-path vault-broker/Cargo.toml -- -D warnings
+    cargo fmt --manifest-path svalinn-cli/Cargo.toml --check
+    cargo clippy --manifest-path svalinn-cli/Cargo.toml -- -D warnings
 
-# Format code
+# Format all Rust source
 fmt:
-    cargo fmt
+    cargo fmt --manifest-path vault-broker/Cargo.toml
+    cargo fmt --manifest-path svalinn-cli/Cargo.toml
 
-# Clean build artifacts
+# Clean all build artefacts
 clean:
-    cargo clean
+    cargo clean --manifest-path vault-broker/Cargo.toml
+    cargo clean --manifest-path svalinn-cli/Cargo.toml
+    cargo clean --manifest-path vault-core/Cargo.toml
+
+# ---------------------------------------------------------------------------
+# Operational: daemon + CLI
+# ---------------------------------------------------------------------------
+
+# Start vault-broker daemon in the background (requires RGTV_AGENT_TOKEN +
+# RGTV_CRED_* env vars to be set in the calling shell).
+broker-start:
+    @echo "Starting vault-broker daemon..."
+    @rgtv daemon start
+
+# Stop the running vault-broker daemon.
+broker-stop:
+    @rgtv daemon stop
+
+# Report daemon health.
+broker-status:
+    @rgtv daemon status
+
+# Tail the daemon log (follow mode).
+broker-logs:
+    @tail -f ~/.local/state/rgtv/vault-broker.log
+
+# List the credential hints registered with the running broker.
+creds:
+    @rgtv list
+
+# Run vault-broker in the foreground (dev mode, logs to stdout).
+# Requires: RGTV_AGENT_TOKEN + one or more RGTV_CRED_<HINT> vars.
+broker-dev:
+    @echo "Starting vault-broker in foreground (dev mode)..."
+    @echo "Required: RGTV_AGENT_TOKEN, RGTV_CRED_<HINT>=<value>"
+    cargo run --manifest-path vault-broker/Cargo.toml
 
 # Generate vexometer traces
 trace input: