A decision surface for the credential vault.
Skarbiec Desktop reads and edits credential values, shows TOTP codes, manages grants and routes, and presents posture, lifecycle, journal, recovery and synchronization. It uses the same broker operations and refusals as the CLI.
Information architecture#
The selected vault is a scope, not a destination. Work is organized by the operator decision it supports: Posture for triage, Requests for approvals and invitations, Lifecycle for credential operations, Items and Grants for vault control, Journal and Recovery for evidence, and Sync and Settings for system state.
Without an explicit window selection, Desktop leaves vault resolution to Skarbiec. It does not adopt the richest discovered local file or promote a client copy over the fleet owner's declared route. The vault scope shows the owner's reported file, route and resolved endpoint for a remote answer. Choose Use configured vault to withdraw a saved window override; an explicitly configured SKARBIEC_VAULT_FILE still belongs to the backend's selection contract. Local discoveries remain available only for explicit selection. An unavailable owner remains an error, not permission to substitute another vault.
Grants → Issue redemption capability is the graphical form of grant capability, separate from issuing a bearer grant. Enter the workload agent, purpose, routed resource, target, lifetime in whole seconds and maximum uses; an authorization identifier is optional. The form supplies no hidden lifetime or use count and preserves the backend's exact refusal, including an unrepresentable expiry. A successful response displays its status and selectable capability identifier, never the credential value. It uses the same owner-selected operator API and shared issuer as the CLI.
Recovery confirms an emergency activation only when the backend returns ok:true, the requested grantee and the shared_items receipt. Missing, unknown or mismatched verdicts remain visible refusals with the observed response fields; a not_yet response retains the backend's activation timestamps. An unreadable answer is never displayed as successful activation.
Severity determines layout. A broken audit chain gets the full-width failure treatment and the backend's exact sentence; a healthy signal remains one line. Large inventories aggregate and facet before enumerating rows, while identifiers, digests, paths, and timestamps remain selectable and monospaced.
Security boundary#
- Every refusal, guard, and receipt quotes the backend result, including its reason code. The client never invents a cause from partial state.
- Irreversible operations require confirmation and keep the safe action primary.
State and failure rules#
- A failed refresh retains the last known-good content and adds a failure banner; it never converts a read failure into an empty vault.
- Not configured is neutral, never an error. Missing evidence and a measured zero are different states.
- Loading, empty-by-data, empty-by-filter, unavailable, stale, and irreversible states have separate presentations and next actions.
- Rows, controls, and navigation remain keyboard and pointer accessible; identifiers and digests remain selectable.
High-risk decisions#
Posture calls the broker's doctor surface rather than reassembling a weaker local health model. Journal places chain faults before entries and keeps the journal path visible. Sync quotes the pull guard and lists every local-only item that would be lost before a destructive pull.
Desktop first use completes only after a real doctor report is observed. Entering the verdict-reading step also observes a report already visible on Posture; it does not require changing vaults or rerunning doctor merely to change the report counts. If the journey rejects that observation as completion evidence, the screen names that rejection rather than telling you the report was not read. Failure to record that observation is distinct from failure to send events after it was recorded. Load, advance, completion, replay and event delivery preserve the typed journey refusal, including an invalid definition's supplied reason, instead of reducing it to an NSError code or a generic retry sentence.
Only one first-use operation runs at a time. Recording the observed verdict owns that operation through event delivery; repeated report callbacks, advance and retry cannot overlap it, and replay reports that the walkthrough is busy rather than resetting an attempt still being recorded.
Grant issuance validates each capability exactly as the CLI does. Issued grant result shows the complete response and offers Copy bearer and Copy complete result before dismissal. Direct grant bearers are returned once; workload-bound grants instead return their acquisition instructions. A refused issuance preserves the existing grant and displays no previous issuance as the new result. Recovery keeps owner and recovery identities, drill evidence and time-locked emergency grants together.
Declared route resolution#
Routes reads the broker's route resolve result, including which item declaration answered each resource. A renamed hand-mapped item is reported by its old and new names instead of being called missing.
Provider, agent and login routes are resolved from item declarations at read time; there is no reconcile-from-vault action. Manual mapping is available for resources an item cannot declare, requires a recorded reason, and refuses names owned by item declarations. Repeating the same mapping leaves the route table unchanged.