Changeset 0.28.6 (#192)

docs/ICD/workspaces.md

@@ -361,13 +361,15 @@ Independent of workspace scope — credentials are user-level.
 
 ```
 POST   /git-credentials             ← { "name", "auth_type", ... }
+POST   /git-credentials/generate    ← { "name", "persona_id?" }
 GET    /git-credentials             → { "data": [GitCredentialSummary] }
+GET    /git-credentials/:id/public-key → { "public_key", "fingerprint" }
 DELETE /git-credentials/:id
 ```
 
 **Auth:** Authenticated user. Credentials are scoped to the requesting user.
 
-**Create request:**
+**Create request (manual):**
 
 `auth_type` determines which fields are required:
 
@@ -379,6 +381,37 @@ DELETE /git-credentials/:id
 
 Returns `201` with the credential summary (never exposes encrypted data).
 
+**Generate request (v0.28.6 — server-side SSH keygen):**
+
+```json
+{
+  "name": "GitHub - main",
+  "persona_id": "uuid"
+}
+```
+
+Generates an ED25519 SSH keypair server-side. The private key is
+vault-encrypted before storage and never leaves the server. Returns
+the credential summary including the public key (authorized_keys
+format) and SHA256 fingerprint. The user adds the public key to their
+git host (GitHub, Gitea, etc.).
+
+Optional `persona_id` binds the key to a persona for commit
+attribution — git operations using this credential will set the
+commit author to the persona's name and handle.
+
+Returns `201`.
+
+**Get Public Key:**
+
+```
+GET /git-credentials/:id/public-key
+```
+
+Returns `{ "public_key": "ssh-ed25519 AAAA...", "fingerprint": "SHA256:..." }`.
+Owner-only — returns `404` for other users or credentials without
+a public key (e.g. PAT credentials).
+
 **List response:**
 
 ```json
@@ -388,12 +421,18 @@ Returns `201` with the credential summary (never exposes encrypted data).
       "id": "uuid",
       "name": "GitHub PAT",
       "auth_type": "https_pat",
+      "public_key": "",
+      "fingerprint": "",
+      "persona_id": null,
       "created_at": "2025-06-15T14:30:00Z"
     }
   ]
 }
 ```
 
+`public_key` and `fingerprint` are populated for `ssh_key` type
+credentials created via `/generate`. Empty for PAT/basic auth.
+
 **DELETE** returns `{"deleted": true}`. Returns `404` if credential
 not found or not owned by the requesting user.