A decision surface for the credential vault.
Skarbiec Desktop reads and edits credential values, shows TOTP codes, manages grants and routes, and presents posture, lifecycle, journal, recovery and synchronization. It uses the same broker operations and refusals as the CLI.
Information architecture#
The selected vault is a scope, not a destination. Work is organized by the operator decision it supports: Posture for triage, Requests for approvals and invitations, Lifecycle for credential operations, Items and Grants for vault control, Journal and Recovery for evidence, and Sync and Settings for system state.
Severity determines layout. A broken audit chain gets the full-width failure treatment and the backend's exact sentence; a healthy signal remains one line. Large inventories aggregate and facet before enumerating rows, while identifiers, digests, paths, and timestamps remain selectable and monospaced.
Security boundary#
- Every refusal, guard, and receipt quotes the backend result, including its reason code. The client never invents a cause from partial state.
- Irreversible operations require confirmation and keep the safe action primary.
State and failure rules#
- A failed refresh retains the last known-good content and adds a failure banner; it never converts a read failure into an empty vault.
- Not configured is neutral, never an error. Missing evidence and a measured zero are different states.
- Loading, empty-by-data, empty-by-filter, unavailable, stale, and irreversible states have separate presentations and next actions.
- Rows, controls, and navigation remain keyboard and pointer accessible; identifiers and digests remain selectable.
High-risk decisions#
Posture calls the broker's doctor surface rather than reassembling a weaker local health model. Journal places chain faults before entries and keeps the journal path visible. Sync quotes the pull guard and lists every local-only item that would be lost before a destructive pull.
Grant issuance validates each capability exactly as the CLI does. Issued grant result shows the complete response and offers Copy bearer and Copy complete result before dismissal. Direct grant bearers are returned once; workload-bound grants instead return their acquisition instructions. A refused issuance preserves the existing grant and displays no previous issuance as the new result. Recovery keeps owner and recovery identities, drill evidence and time-locked emergency grants together.
Declared route resolution#
Routes reads the broker's route resolve result, including which item declaration answered each resource. A renamed hand-mapped item is reported by its old and new names instead of being called missing.
Provider, agent and login routes are resolved from item declarations at read time; there is no reconcile-from-vault action. Manual mapping is available for resources an item cannot declare, requires a recorded reason, and refuses names owned by item declarations. Repeating the same mapping leaves the route table unchanged.