statecraft.
Catalog/statecraft-cli

051-host-held-provider-credentials

The supervisor holds the provider token behind a loopback gateway; the child holds only a per-attempt token

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Replaces spec 042's delivery of the operator's provider token in the child's environment with a loopback authentication gateway the supervisor owns. The child receives the gateway's address and a short-lived token minted for its attempt, through a 0600 file in the per-run configuration directory; the gateway checks that token and forwards with the real one, and revokes it when the attempt ends. The provider token never appears in the child's environment or files. Claude Code's honouring of a base-URL override with an OAuth token in print mode is measured, unconfined; the confined measurement is part of acceptance.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "additive",
  "spec": "002-environment-lifecycle",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-home/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "004-execution-adapter",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-adapter/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "004-execution-adapter",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-adapter-claude-code/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "006-command-surface",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-cli/"
  }
}

Source headings

  1. 051: Host-held provider credentials
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 The gateway
  6. 3.2 The per-attempt token
  7. 3.3 Confinement
  8. 3.4 Refusal, not fallback
  9. 4. Out of scope
  10. 5. Resolved decisions
  11. Verification

Frozen anchors

No frozen anchors declared.