[annavesela]

Status: ready for review (source and native candidate). Not deployed; installed consumer acceptance remains open.

A local Organization application can declare an optional runtime key, but the vault previously refused every workstation before reading it. This adds explicit macOS onboarding for a fresh, separate technical account per Organization and selects that account from the module's declared Organization at each start. A missing connection keeps optional-key applications usable without their provider capability.

The operator runs vault connect-workstation --folder … --organization … --server … --name …. This records non-secret metadata and prints the generated account for the service administrator to pre-allow. setup, status, refresh and env accept the same selectors. Existing own-vault registration, credential custody, synchronization and secret parsing remain the only credential path. Disconnect removes local admission without deleting the remote vault; already running applications must be stopped to retire supplied keys. Hosted admission and Personalspace isolation remain intact.

The design and failure contract are in docs/workstation-vault.md. There is no human-account import, browser-session extraction, environment-file fallback, invented hosted handover or legacy-launcher workaround. This is CLI onboarding; the workstation's generic Vault page still has no Organization selector. Linux workstation onboarding is not enabled. The catalog defers Organization workstation admission to the dynamic source at start.

Validation:

• Native macOS: vault/runtime regression selection: 159 tests passed across 19 files, zero failures.
• Added CLI onboarding/disconnection test passed separately; four workstation tests pass.
• Static check: lint, TypeScript, publication guard, standalone proof build and smoke passed.
• Standalone darwin-arm64 candidate built from dfda0d2309657c5cdaec9d6728b59a8bbc6522ba; SHA-256 f35f9c62d5b1d8115c2e1b1823d44cf74cfbda417c0d303ed0fa68ef0eeef03e. Native smoke passed CLI initialization/profile update, embedded HTML, authenticated API admission and graceful shutdown with development runtimes excluded from PATH. This is an unattested development candidate, not an installed product or live provider proof.

Deployment remains bounded by the separate legacy-Folder migration and product activation contracts. Live service pre-allowance and a designated provider test have not happened. This PR does not close #313's installed consumer acceptance.

Work context: DEV-6631, branch codex/DEV-6631-workstation-vault, owner-scoped productionspace worktree. Codex on a native macOS arm64 workstation. Exact local session and machine locators remain in the private sidecar rather than this public product repository.

Refs #313.

[immakermatty]

Merge freeze on main for the LazurioPlatform v0.1.13 release, from 2026-10-26 ~08:40Z until the final v0.1.13 is out (expected this evening, UTC).

The candidate v0.1.13-rc.1 is main at 2bd9b438, and it runs its canary today. Anything merged into main before the final would not be in the canary, so it would have to go into v0.1.14. Please don't merge into main until the release owner (the DEV-6656 thread) says the final is out. Review, rebase and approval can go on as usual.

[immakermatty]

The merge freeze for v0.1.13 is lifted. main already carries #661, which reached it after the candidate, so the final v0.1.13 is built on a release branch that restores the candidate's tree. Later merges into main don't change that final, so main can take merges again; they go into v0.1.14.

[agentrozjedemeai]

Prosím zachovejte diagnostiku nedostupného vaultu na nepodporovaných pracovních stanicích. declaredSecretsFinding nyní u každé organizační aplikace na workstation vrací prázdný nález (src/modules/runtime-secrets.ts:243–247), ale readVaultContext připojení na Linuxu nadále bezpodmínečně odmítá (src/vault/host.ts:92–94). Na linuxové stanici proto katalog označí aplikaci s povinným klíčem jako spustitelnou a doctor neohlásí známou příčinu; teprve pokus o spuštění skončí runtime-secret-unavailable. U volitelného klíče zmizí také diagnostická poznámka. Před touto změnou katalog tyto stavy uváděl. Prosím rozlište platformy tak, aby se dynamický výběr použil na macOS a nepodporované stanice si zachovaly nález workstation, a pokryjte povinný i volitelný klíč regresním testem katalogu/diagnostiky.

— Pablo