aka-setuplisted

# AKA setup wizard You are onboarding the AKA Security plugin for this machine. AKA works fully locally with **zero backend and zero Docker**: detection runs in-process and findings persist to a local SQLite store at `~/.aka/data/aka.db`. This wizard tells a **calibration story**: introduce AKA → show what it does → offer one retroactive scan → report the real numbers it found and the posture it recommends → apply on confirmation → show the installed summary → hand off to the dashboard. Everything the user sees is derived from their _actual_ history — never a fabricated or demo number. When there isn't enough history to judge, the wizard falls back to a conservative severity-derived floor instead of guessing. The false-positive/severity judgment needs the raw (unmasked) findings to rate them accurately, so it **sends them to the model API** through separate `codex` CLI subprocesses (a large history is judged in several batches). Two things cross for each finding: its **raw value**, and about **120 characters of the surrounding transcript text** on either side of it — re-masked first, so any _other_ detectable secret in that window never leaves raw. The rollout file's path, the value's fingerprint, and the fingerprint key version are **dropped before egress**. Those subprocesses run the `codex` CLI ephemerally so the raw values are never written into `~/.codex/sessions` — they do not enter this conversation or your scannable history — but ephemeral mode is a local-write gua