execute

name	execute
description	Implementation methodology for cert-mgmt-tool backlog items. Covers scoped Go/Bubble Tea development, native keystore engine constraints, worktree workflow, verification, and commit conventions.
schedule	When backlog items are ready for implementation. Use as the primary stage for one bounded vertical slice.

Execute

You implement one bounded cert-mgmt-tool (certtui) backlog item. The order prompt says what to build; this skill says how to work.

Operate autonomously. Do not ask the user unless secrets, credentials, or an irreversible product decision are required.

1. Load project truth

Before editing, read:

• CONTEXT.md for domain terms and behavior.
• docs/adr/0001-native-keystore-engine.md for the native Go engine decision.
• The assigned issue/backlog text and any linked plan.

Keep language consistent: Keystore, Alias, Bundle, Bundle Entry, Write-back, Import, Copy, Export, Delete, Keytool Hint, Expiring.

Core product constraints:

• Go + Bubble Tea TUI named certtui.
• Invocation shape: certtui <path>.
• Detect JKS, PKCS12, PEM, and Bundle content by bytes/content, not filename.
• Normal operation uses native Go libraries (keystore-go, go-pkcs12, crypto/x509), not shelling out to keytool.
• PKCS12 with multiple key pairs is read-only until library support improves.
• Every mutation saves a timestamped backup first.
• Keytool Hints are escape hatches for refused/failed mutations, not the primary engine.

2. Scope tightly

Write down the bounded slice in your own words:

• What changes.
• What does not change.
• What tests prove it.

Do not pull in later slices just because they are nearby. If you discover missing prerequisites, either implement the smallest prerequisite needed for this slice or stop with a clear blocker note.

3. Worktree workflow

Never edit main directly when running under Noodle.

• If already in a Noodle worktree, use it.
• Otherwise create one:

noodle worktree create <short-slice-name>

Use noodle worktree exec <name> <cmd> or absolute paths. Avoid leaving shells cd'd into worktrees.

Commit inside the worktree. Merge only after verification:

noodle worktree merge <short-slice-name>

4. Implementation standards

• Prefer small packages with explicit domain types over UI-driven data blobs.
• Separate parsing/engine logic from Bubble Tea UI state.
• Add golden/test fixture files for keystore, PEM, and bundle behavior when useful.
• Never log or expose private key material. Exporting a key-pair Alias exports certificate chain only.
• For confirmation flows, show subjects and fingerprints where the domain requires it.
• Keep errors actionable; for unsupported writes include enough context to produce a Keytool Hint.

5. Verification

Run the strongest available checks before commit. For a fresh Go repo, bootstrap only when the task requires code.

Typical commands:

gofmt -w <changed-go-files>
go test ./...
go test -race ./...

If there are scripts/Makefile/CI commands, prefer the project-standard command and then targeted Go tests. If a JDK-dependent interoperability test exists, make it skip cleanly when no JDK/keytool is installed.

Never commit failing tests. If an external dependency prevents a check, note the exact command and failure.

6. Commit

Use one conventional commit per logical slice:

feat(<scope>): <short description>
fix(<scope>): <short description>
test(<scope>): <short description>
docs(<scope>): <short description>
chore(<scope>): <short description>

Include Refs: #<issue> when the order maps to a GitHub issue.

7. Yield

After merge/commit and verification, emit a stage yield when $NOODLE_SESSION_ID is set:

noodle event emit --session "$NOODLE_SESSION_ID" stage_yield --payload '{"message":"Implemented: <brief summary>"}'

Final output should include changed files, verification commands, commit hash, and any residual risks.