Credential broker boundary¶
Provider credentials (OAuth refresh tokens, API keys, provider CLI state) stay on the Mac where the provider is signed in. The Bridge reports which provider account slots it has and whether they are signed in; a task names the slot it runs under, and the server only checks that the Bridge identity is allowed to use it. HeyAira never receives, stores or brokers the secret material itself.
What was removed¶
An earlier design planned an in-process credential broker in the server:
short-lived credential leases bound to project, provider account, Bridge,
device, session and credential version, read-only OpenBao policies generated
per credential, a deterministic in-memory OpenBao fixture, and an OpenBao KV
adapter reading provider secrets per lease. That contract was library code
only. It was never wired into the server, never deployed, and nothing used
it once provider credentials stayed on the Mac, so it was removed
(CredentialBroker, CredentialRequest, CredentialScope,
CredentialLease, AuditEvent, SecretMaterial, InMemoryOpenBaoFixture,
render_openbao_policy and the OpenBao secret adapter OpenBaoSecretStore).
What remains¶
CredentialBrokerError(src/heyaira/credential_broker.py): the stable, non-secret error type of the Bridge identity and enrollment boundary, used by the persistence adapter and the enrollment transport.- OpenBao as the external store of the mobile push-token vault
(
OpenBaoKV2SecretStoreinsrc/heyaira/openbao.py; see BRIDGE_OPENBAO). Production refuses to start without it.