From 923a8026c9e3c8020f13e9801b48d9b35f4901ed Mon Sep 17 00:00:00 2001
From: Gustavo Bertoi <gustavobertoi@outlook.com>
Date: Mon, 29 Jun 2026 15:45:26 -0300
Subject: [PATCH] docs(progress): X7 complete (uninstall PR #61) + S5 login;
 night-3 cont.

---
 PROGRESS.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/PROGRESS.md b/PROGRESS.md
index 13afa7f..6945b0d 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -72,7 +72,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [x] X4 profiles/selective-up — **DONE** (PR #53: internal/profile.Resolve — Q-PROFILE resolved). Saga --profile wiring is X5.
 - [x] X5 orchestrate completion — **DONE** (PR #55: `up --profile` service-slicing wired into BuildUp — inactive projects drop out, compose-up restricted to active services, shared phase + health gate pruned to `active.Shared`; PR #57: spec-12 `memoryBudgetMB` over-budget warning). Follow-up (small): spec-native `COMPOSE_PROFILES`/`profiles:` emission.
 - [x] X6 `internal/doctor` full matrix + `--fix` — **DONE** (trust/dns/shared probes PRs #33/#35/#48 + safe reconcile `--fix` PR #49)
-- [~] X7 `workspace destroy`/`uninstall` — **PARTIAL**: `workspace destroy` done (PR #56: data-preserving teardown — stacks down, ref/port rows dropped under lock, orphaned shared warm-stopped via GC, `.devstack/` removed). Remaining: `--purge-data` (needs `docker volume rm` capability) + `uninstall` (machine-global incl. CA removal across host/Firefox/Windows).
+- [x] X7 `workspace destroy`/`uninstall` — **DONE** (PR #56 `workspace destroy` data-preserving teardown; PR #61 `uninstall` machine-global teardown: compose down -v all stacks → network rm → CA removal (host/Firefox/Windows) → /etc/hosts → aliases → XDG dirs, best-effort + confirm-gated). Minor follow-up: `destroy --purge-data` (uninstall already does the full-machine purge).
 - [x] X8 self-update notifier — **DONE** (PR #25, `28c4a78`)
 - [ ] X9 `internal/migrate` + `import` — TODO
 
@@ -110,3 +110,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **N5 merged — M5 networking COMPLETE** (PR #51) — fenced trust phase in the up saga (opt-in mkcert install when httpsLocal; never aborts up). M5 N1–N5 all done. **51 PRs merged.** Remaining frontier (all flagged / heavy-dep / large-scope / needs-fresh-context): provision saga phase (D8 pgx host-port — flagged design call), S3/S4 (aws-sdk/infisical deps + localstack), S5-login (keyring), X4 (Q-PROFILE fork), X5 (needs provision+X4), X7 (teardown), X9 (devdock format), G2 (macOS CI), G5 (two-terminal race e2e).
 - (night 2 cont.) **X4 merged** (PR #53) — the selective-up profile resolver (internal/profile.Resolve; Q-PROFILE RESOLVED = both planes unioned, `all` default). **52 PRs merged.** X5 (saga --profile slicing + DAG-pruned health) now ready. Remaining: X5, X7 (teardown), provision phase (flagged D8 host-port), S3/S4 (deps+services), S5-login (keyring), X9 (devdock format), G2 (macOS CI), G5 (race e2e).
 - (night 3) **X5 + X7-destroy + memory-budget merged** (PRs #55–57) — selective-up is now end-to-end: `up --profile` slices the saga (inactive projects drop out, compose-up restricted to active services, shared phase + health gate pruned to `active.Shared`), plus the spec-12 `memoryBudgetMB` over-budget warning. `workspace destroy` lands the data-preserving teardown (stacks down, ref/port rows dropped under lock, orphaned shared warm-stopped via GC, `.devstack/` removed; volumes/DBs + machine-global state preserved). **57 PRs merged.** Remaining: X7 remainder (`--purge-data` needs `docker volume rm`; `uninstall` = machine-global incl. CA removal), S5-login (keyring + WSL2 fallback), S3/S4 (aws-sdk/infisical + localstack), provision saga phase (flagged D8 host-port), X9 (devdock format — flagged), G2 (macOS CI), G5 (race e2e), G3 docs remainder (migration/threat-model).
+- (night 3 cont.) **S5-login + X7 COMPLETE merged** (PRs #59, #61) — keyring-backed `secrets login/logout/status` (zalando/go-keyring + WSL2 env-var degrade; `CredentialFor` env→keyring→native) finishes M4's S5; and `uninstall` (machine-global teardown: compose down -v all stacks → external network rm → CA removal across host/Firefox/Windows → /etc/hosts → alias symlinks → XDG ledger/cache/config, best-effort + confirm-gated) finishes X7 alongside `workspace destroy`. **61 PRs merged.** Remaining: S3 (AWS SM+SSM — heavy aws-sdk + localstack), S4 (Infisical — gated), provision saga phase (D8 pgx host-port — decision known, wiring deferred; unblocks X3 firstRun), X3 remainder (firstRun/postPull + hook flags), X9 (devdock import — format unknown, flagged), G2 (macOS CI — unverifiable locally), G3 docs remainder (migration + threat-model), G4 (tap + `.deb`/`.rpm` + tag v1.0), G5 (two-terminal race e2e).