feat!: replace --ref with global --profile selector

[rianjs]

Summary

• Replace the public --ref <service>/<profile> selector with inherited global --profile <name> in both gro and grw.
• Keep service-qualified credential refs, config and environment precedence, internal OpenRef use, and JSON ref fields unchanged.
• Remove init and set-credential local selector shadows; bump the release line to 2.0.

Closes #28

Validation

• Focused Go tests pass.
• make check passes, including lint, race tests, and builds.
• make test-cover-check passes at 75.5% coverage (60% threshold).
• Built help for both binaries and mail search, init, and set-credential shows inherited --profile with no public --ref.
• Invalid --profile bad.profile fails at the validation boundary, and --ref is unknown in both binaries.
• ./bin/gro profiles list --profile rstockbower marked rstockbower active via --profile flag; a following unqualified list still marked monit active.

Live me and mail API calls stalled without output and were interrupted; they are left for operator follow-up.

[rianjs]

Test coverage assessment — PR #29

Major

• The removed public --ref surface is not tested on the changed concrete commands or on grw. TestPublicRefFlagIsUnknown only invokes a throwaway gro probe (internal/app/gro/credref_wire_test.go:116). It passes if set-credential retains a local --ref, because the probe does not have that flag; TestProfile_SetCredentialInheritsPersistent verifies only --profile (internal/app/gro/credref_wire_test.go:73). Add command-level rejection/absence coverage for gro and grw, especially set-credential, plus the documented root/init/mail paths.

• Init’s inherited-flag bridge is unprotected. The new production bridge copies cmd.Flag("profile") into opts.profile (internal/cmd/init/init.go:75), but the guidance test calls runWith with initOptions{profile: "work"} already populated (internal/cmd/init/init_test.go:1187). It would pass if NewCommand stopped reading the inherited flag, leaving real init --profile work correctly targeted by the root override but without the non-active-profile guidance. Exercise the Cobra command path (with injected dependencies or a focused seam) and assert the guidance and unchanged configured profile.

• The changed set-credential migration path has no behavioral test. The implementation replaces explicit EnsureMigrated + OpenRef with Open (internal/cmd/setcred/setcred.go:84), while its new test directly seeds SetCredentialRefOverride and calls run (internal/cmd/setcred/setcred_test.go:44). It never plants legacy state or observes migration/conflict behavior, so it passes if the command regresses to OpenRef/skips migration. Add hermetic cases proving default-target legacy migration or conflict blocks a write, and a --profile target does not migrate the default profile’s legacy credential.

Minor

• Invalid-profile tests do not prove the promised fail-before-I/O ordering. Both app tests use no-op probe commands (internal/app/grw/profile_wire_test.go:36); they establish an error but cannot detect a future validation path that opens the keyring/API before failing. A small collaborator/sentinel test at the keychain boundary would preserve that fail-fast guarantee.

[rianjs-bot]

Automated PR Review

Reviewed commit: 92417b88ec78
Profile: codex-rianjs-bot - Posting as: rianjs-bot[bot]

Summary

Reviewer	Findings
documentation:docs	0
go:implementation-tests	0
policies:conventions	0
structure:repo-health	0

Reviewer Coverage

• documentation:docs — complete (broad); inspected 1 assigned file (17 inspected across reviewers): docs/development.md; skipped: none; constraints: Narrow documentation-only review; verified the changed release-version statements against version.txt, packaging/identity.yml, and repository release workflows.
• go:implementation-tests — complete (broad); inspected 15 assigned files (17 inspected across reviewers): internal/app/gro/backend_wire_test.go, internal/app/gro/credref_wire_test.go, internal/app/gro/root.go, internal/app/grw/profile_wire_test.go, internal/app/grw/root.go, internal/cmd/init/init.go, internal/cmd/init/init_test.go, internal/cmd/profiles/profiles.go, internal/cmd/setcred/setcred.go, internal/cmd/setcred/setcred_test.go, internal/config/config.go, internal/keychain/credref_test.go, internal/keychain/keychain.go, internal/keychain/wire.go, internal/rootutil/rootutil.go; skipped: none; constraints: Focused Go tests passed with CGO disabled and repository keyring build tags; native CGO compilation is unavailable in this workspace due to a path/toolchain error.
• policies:conventions — complete (broad); inspected 11 assigned files (17 inspected across reviewers): docs/development.md, internal/app/gro/root.go, internal/app/grw/root.go, internal/cmd/init/init.go, internal/cmd/profiles/profiles.go, internal/cmd/setcred/setcred.go, internal/config/config.go, internal/keychain/keychain.go, internal/keychain/wire.go, internal/rootutil/rootutil.go, version.txt; skipped: none; constraints: Focused Go tests could not build because the compiler invocation mishandled the workspace path containing spaces; this did not affect the static convention review. The optional local cli-common and shared-automation documentation copies were not present, so this review used the repository-local standards and linked breadcrumbs only.
• structure:repo-health — complete (broad); inspected 8 assigned files (17 inspected across reviewers): docs/development.md, internal/app/gro/root.go, internal/app/grw/root.go, internal/cmd/init/init.go, internal/cmd/profiles/profiles.go, internal/cmd/setcred/setcred.go, internal/config/config.go, internal/rootutil/rootutil.go; skipped: none; constraints: Review scoped to the assigned changed files and their directly relevant wiring/tests. Focused test command could not compile in this environment because the RTK shell proxy truncated a workspace path; the supplied validation reports focused tests and make check passing.

Inspected files (17)

• docs/development.md
• internal/app/gro/backend_wire_test.go
• internal/app/gro/credref_wire_test.go
• internal/app/gro/root.go
• internal/app/grw/profile_wire_test.go
• internal/app/grw/root.go
• internal/cmd/init/init.go
• internal/cmd/init/init_test.go
• internal/cmd/profiles/profiles.go
• internal/cmd/setcred/setcred.go
• internal/cmd/setcred/setcred_test.go
• internal/config/config.go
• internal/keychain/credref_test.go
• internal/keychain/keychain.go
• internal/keychain/wire.go
• internal/rootutil/rootutil.go
• version.txt

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 2m 11s | gpt-5.6-terra | cr 0.10.311

Field	Value
Model	gpt-5.6-terra
Reviewers	documentation:docs, go:implementation-tests, policies:conventions, structure:repo-health
Engine	codex_cli · gpt-5.6-terra
Reviewed by	cr · rianjs-bot[bot]
Duration	2m 11s wall · 4m 53s compute
Cost	unavailable
Tokens	1.1M in / 10.3k out

Per-workstream usage

• orchestrator-selection — gpt-5.6-terra
  • In: 17.4k
  • Out: 536
  • Cache read: 11.0k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 13s
• documentation:docs — gpt-5.6-terra
  • In: 82.3k
  • Out: 1.1k
  • Cache read: 68.6k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 28s
• go:implementation-tests — gpt-5.6-terra
  • In: 482.0k
  • Out: 3.3k
  • Cache read: 413.4k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 1m 38s
• policies:conventions — gpt-5.6-terra
  • In: 255.2k
  • Out: 2.3k
  • Cache read: 201.2k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 1m 07s
• structure:repo-health — gpt-5.6-terra
  • In: 196.9k
  • Out: 2.6k
  • Cache read: 143.1k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 1m 21s
• orchestrator-rollup — gpt-5.6-terra
  • In: 38.0k
  • Out: 574
  • Cache read: 28.2k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 5s