Architecture

┌─────────────────────────────────────────────────────────┐
│                   AI Agent (Hermes / LLM)                │
│  "run psql with DATABASE_URL"                            │
└────────────────────┬────────────────────────────────────┘
                     │ CLI / HTTP
                     ▼
┌─────────────────────────────────────────────────────────┐
│                   trustless CLI                          │
│                                                         │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐              │
│  │ secret   │  │ run      │  │ proxy    │              │
│  │ (list/   │  │ (subproc │  │ (HTTP    │              │
│  │  get/set)│  │  inject) │  │  proxy + │              │
│  └────┬─────┘  └────┬─────┘  │  MITM)   │              │
│       │             │        └─────┬─────┘              │
│       │             │              │                    │
│  ┌────┴─────────────┴──────────────┴─────┐              │
│  │            Backend Interface          │              │
│  │  (pass / env / bitwarden — swappable) │              │
│  └─────────────────────┬──────────────────┘             │
└────────────────────────┼────────────────────────────────┘
                          │
            ┌─────────────┴─────────────┐
            │                           │
            ▼                           ▼
     ┌──────────────┐          ┌──────────────┐
     │  pass store   │          │  Target API   │
     │  (GPG + pass) │          │  / Service    │
     └──────────────┘          └──────────────┘

Backend Abstraction

The credential resolver is abstracted behind a simple interface:

type Backend interface {
    Resolve(ctx context.Context, key string) (string, error)
    List(ctx context.Context) ([]Entry, error)
}

Implemented backends:

• pass (default) — wraps pass show <key>, reads first line as secret
• env — reads from environment variables via os.Getenv() (for CI/CD, containers)
• bitwarden — wraps the bw CLI (bw list items), resolves secureNote fields[value] / login passwords / notes first line. Session key is passed via BW_SESSION env (never argv). Unlock via trustless bw-unlock (session key saved to ~/.config/trustless/bw-session, 0600). Fails closed on invalid session. Details: docs/bitwarden-backend-design.md

Configure via trustless config set backend <name>.