feat(security): delete the vault and the passphrase gate; autonomy becomes a profile choice

[eaitbrahim]

Removes both local security mechanisms from spec §14 and replaces them with one rule: dangerous actions need a human at a terminal; nothing needs a stored secret.

The rails are untouched. All 17 still run first, un-overridable, in every mode. This changes who is asked, never what is allowed. Every claim below has a test.

The vault is gone — and it was already dead code

keel/security/secrets.py (AES-GCM secrets.enc) is deleted, along with the now-unused cryptography dependency.

Worth stating plainly, because it changes how you should read the diff: the vault was never on the live path. data/cb_client.py and cli.py have always loaded credentials via config.load_secrets() from a git-ignored .env; the vault was reachable only through migrate_from_env. Deleting it removes a competing credential path rather than changing how credentials are actually loaded. (PR #115, which would have wired it up, was closed for this reason.)

The passphrase gate is gone

keel/security/authz.py is deleted. Of its four declared dangerous actions, raise_caps and unlock_vault were never used at all — caps are config-file-only, and the vault had no CLI surface. arm_bypass disappears with bypass mode.

That left four commands, all one idea — re-permitting trading after a safety halt: resume, resume-entries, record-flow, reset-hwm. Each now demands a typed yes (not a bare y) and fails closed off a TTY.

The reasoning is coherence. Since #117, placing a real, money-spending order needs only a typed confirmation. Requiring a remembered secret to reset a high-water mark is ceremony without a matching threat model — and the old gate's own docstring conceded it "does not stop an attacker who already holds the OS account". One rule is easier to audit than two.

⚠️ There is deliberately no env-var or flag override for the TTY check. I started to add one as a test seam and rejected it: any such seam is settable from cron and would defeat every fail-closed built on it. Tests patch the predicate instead.

Autonomy is a profile choice, not a config mode

New profile table (schema 6 → 7) holds the user's autonomous flag.

keel autonomy show
keel autonomy on     # typed "yes", terminal required
keel autonomy off    # always allowed, works from a script or cron

auto_trade.mode collapses to paper | confirm, so there are two independent switches rather than one enum conflating both:

mode	autonomous	result
paper	(ignored)	simulated, places nothing
confirm	false (default)	live, asks before every order
confirm	true	live, places without asking

Four properties, each tested:

• Read live, never cached — _effective_mode re-reads the profile every cycle, so keel autonomy off binds on the next order, not the next restart. (Mirrors rail 14's allowance, moved to the DB for the same reason.)
• Fails closed — an absent or deleted profile row reads as not-autonomous. A database that never recorded a choice must not imply consent.
• Enforced in-process — the check lives inside run_once, not only at the CLI, so a caller driving run_once directly cannot obtain autonomy the CLI would refuse.
• Not scriptable to enable — autonomy on requires a terminal. off deliberately does not: reducing risk must never be obstructed.

Autonomy does not clear safety halts

The one place I deliberately did not honour "autonomous means no confirmation". The four halt-releasing commands still demand a human with autonomy fully on — there is a test named for it. "Trade without asking me" and "un-stick your own drawdown breaker" are different powers; a breaker that can reset itself is not a breaker.

⚠️ Breaking

A config carrying mode: bypass or bypass_arm_ttl_sec now fails to load, naming the key and telling you what to do (mode: confirm plus keel autonomy on). Previously an unknown mode degraded silently to confirm. A config saying bypass was explicitly asking for autonomy, and quietly reinterpreting that request — in either direction — is worse than stopping. Run keel migrate to add the profile table; delete any secrets.enc/authz.json (both are simply ignored now).

Also

The go-live runbook is rewritten (supersedes #116, which documents the arm-bypass/passphrase dance that no longer exists) and is honest that its purpose is proving the plumbing — place_order has still never run against the real API — not profit. Spec §14 is marked BUILT THEN REMOVED with the reasoning, so neither mechanism gets re-proposed from the old text.

Verification

1277 tests pass, ruff clean. Grep-proven: zero live references to authz, save_vault, arm_bypass, is_bypass_armed, bypass_arm_ttl_sec or secrets.enc anywhere in keel/, packages/, tests/ or scripts/.

Smoke-run against the real CLI, not just unit tests: a v6 database migrating 6 → 7; autonomy on piped (refused — "needs an interactive terminal"); autonomy off piped (allowed); resume piped (refused); and a mode: bypass config failing to load with the key named.

Design: docs/superpowers/specs/2026-07-21-security-simplification-design.md.