Cred Broker

Cred Broker turns authenticated execution context into narrowly scoped, short-lived provider credentials. Callers request capabilities such as repo.read or pr.manage; policy—not the caller—selects the provider authority and delivery mechanism.

The project is an independent authority component in the Vuoro ecosystem. Vuoro may compose its API, while Cred Broker retains ownership of authorization, provider translation, credential issuance, and security receipts.

Current status

This is an experimental, production-gated implementation. It includes:

• canonical repository registration and drift checks;
• host, subject, session, project, repository, and capability policy;
• decision receipts that never persist credential values;
• certificate-bound server-side sessions;
• an mTLS broker API and separate public health/OIDC listener;
• repository-narrow GitHub App token minting;
• Forgejo v16 Generic JWT Authorized Integration minting;
• local mock/test tooling.

Provider adapters are disabled until an operator supplies dedicated provider identities, a protected signing/key substrate, enrolled client certificates, and live positive and negative canary evidence.

Security model

• Request bodies never establish subject, session, or host identity.
• Git remotes and working directories are locators, not authenticators.
• Ordinary callers never receive forge-administrator credentials.
• Provider authority broader than the requested capability is reported and denied unless policy explicitly accepts that gap.
• Credential values must not enter logs, exceptions, receipts, command-line arguments, fixtures, or committed configuration.

Read the threat model before enabling a live adapter.

Development

Python 3.12 and uv are required.

uv sync --extra test
uv run --extra test pytest
uv build

The local commands require the explicit --test-context switch. Production identity is constructed from verified mTLS and server-side session state.

uv run credctl --config config/development.json explain repo.read \
  --test-context --subject usr_operator --session ses_demo --host devbox \
  --repository mock:example/cred-broker

Deployment boundary

This repository contains neutral application packaging only. Real repository inventories, internal hostnames, PKI enrollment, provider installation IDs, integration audiences, secret-manager policy, and Kubernetes rollout state belong in a private deployment repository.

License

MIT. See LICENSE.