[brtkwr]

Context

PLAT-1314 requires clear diagnostics when the OS keychain backend is unavailable. Credential writes already format known Linux backend failures, but reads discard every keychain failure as “no API key found,” and deletes return the raw backend error. Users are sent back to login even when their stored key cannot be read because the backend is unavailable or access is denied.

Changes

• Preserve non-not-found read failures with the affected context and underlying cause.
• Apply the existing missing-backend guidance to reads and deletes as well as writes.
• Retain login guidance for absent keys, no-op deletion for absent entries, and keychain bypass for explicit flag/environment keys.
• Document the behavior and add regression tests with the keyring dependency's in-memory failure provider.

Scope / Non-goals

No credential storage backend, live credentials, or configuration-selection behavior is changed. This starts from refreshed main including externally merged #9; open #6/#8 are independent. PLAT-1314 was already Bharat-owned/In Progress, and the ownership/branch/PR audit found no competing implementation.

Validation

On exact head 57a71b9d076af2c95586e138c191b30e750ab7fb, CI run 40862351741 passed both jobs:

• build: go build ./..., embedded-spec drift verification, and all tests through make test-cover passed, including the 80% coverage gate.
• lint: all repository lints passed, including formatting.
• Regressions cover missing dbus-launch and wrapped socket dial failures across keychain reads, writes and deletes, while retaining error causes and unrelated errors.
• No local tests. Review fixes were pushed through the GitHub connector with an expected-head lease; the remote head and changed file contents were verified.

Ticket

Refs PLAT-1314.

✨ via Codex session

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T11:04:37.395992Z	57a71b9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b0aa5862e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Puvendhan]

LGTM. A real keychain error (anything other than ErrNotFound) now surfaces with the context name instead of looking like 'no key stored'. DeleteKey wraps it the same way. --api-key and TWO_API_KEY still bypass the keychain, and nothing falls back to a file.