@eduwork/dsh-oidc 0.2.4 → 0.3.0-dev.1

package/lib/profile.js

@@ -1,10 +1,8 @@
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
-export const DEFAULT_CREDENTIAL_REF = 'EDUWORK_API_KEY'
 const MAX_PROFILE_BYTES = 512 * 1024
 const idPattern = /^[a-z][a-z0-9-]{0,63}$/
-const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
 const colorPattern = /^#[0-9a-fA-F]{6}$/
 const allowedModalities = new Set(['text', 'image'])
 const allowedThinkingLevels = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
@@ -15,10 +13,9 @@ const allowedThinkingFormats = new Set([
 ])
 const allowedRootKeys = new Set([
   'schemaVersion', 'id', 'displayName', 'organization', 'nativeInstitutionID',
-  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
+  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'auth', 'provider',
 ])
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
-const allowedKeyBindingKeys = new Set(['type', 'baseURL', 'credentialRef'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
   'loginTitle', 'loginDescription', 'supportURL',
@@ -217,9 +214,6 @@ export function normalizeModels(models, providerID) {
   }))
 }
 
-export function legacyCredentialRefs(profile) {
-  return [...new Set([profile.id, profile.provider?.id].filter(Boolean).map(id => `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`))]
-}
 
 function normalizeRetryPolicy(value) {
   const source = object(value, 'profile.provider.retryPolicy')
@@ -281,35 +275,41 @@ export function normalizeEnterpriseProfile(raw) {
   if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
     throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
   }
-  const oidc = object(source.oidc, 'profile.oidc')
-  const identityOnly = source.keyBinding === undefined && source.provider === undefined
-  if (!identityOnly && (source.keyBinding === undefined || source.provider === undefined)) {
-    throw new Error('profile.keyBinding and profile.provider must either both be present or both be omitted')
+  const gateway = source.auth !== undefined
+  if (gateway && source.oidc !== undefined) throw new Error('profile.auth cannot be combined with oidc')
+  let auth
+  if (gateway) {
+    const rawAuth = object(source.auth, 'profile.auth')
+    exactKeys(rawAuth, new Set(['discoveryUrl', 'expectedIssuer', 'experimentalOidcLlm', 'clientId', 'identityMode']), 'profile.auth')
+    const experimental = rawAuth.experimentalOidcLlm === true
+    if (rawAuth.experimentalOidcLlm !== undefined && typeof rawAuth.experimentalOidcLlm !== 'boolean') throw new Error('profile.auth.experimentalOidcLlm must be boolean')
+    if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined)) throw new Error('profile.auth clientId and identityMode require experimentalOidcLlm=true')
+    if (experimental && !['oauth', 'oidc'].includes(rawAuth.identityMode)) throw new Error('profile.auth.identityMode must explicitly select oauth or oidc')
+    if (experimental && allowedInsecureOrigin && !rawAuth.expectedIssuer) throw new Error('development oidc-llm requires expectedIssuer')
+    const developmentOrigin = experimental ? allowedInsecureOrigin : undefined
+    auth = Object.freeze({
+      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment, developmentOrigin),
+      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment, developmentOrigin) }),
+      ...(experimental ? { experimentalOidcLlm: true, clientId: text(rawAuth.clientId, 'profile.auth.clientId', 256), identityMode: rawAuth.identityMode } : {}),
+    })
+    if (source.provider?.baseURL !== undefined) throw new Error('profile.auth derives provider.baseURL from validated discovery')
+    if (source.provider?.modelSource !== undefined && source.provider.modelSource !== 'discovery') throw new Error('profile.auth requires discovery modelSource')
   }
-  const keyBinding = identityOnly ? {} : object(source.keyBinding, 'profile.keyBinding')
-  const provider = identityOnly ? {} : object(source.provider, 'profile.provider')
+  const oidc = gateway ? {} : object(source.oidc, 'profile.oidc')
+  const identityOnly = !gateway
+  if (identityOnly && source.provider !== undefined) throw new Error('OIDC identity profiles cannot configure model resources; use auth.discoveryUrl for Access Token model access')
+  const provider = gateway ? { id, adapter: 'openai-compatible', ...object(source.provider ?? {}, 'profile.provider'), modelSource: 'discovery' } : {}
   exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
-  exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
   exactKeys(provider, allowedProviderKeys, 'profile.provider')
   const providerID = identityOnly ? id : text(provider.id, 'profile.provider.id', 64)
   if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
-  let credentialRef = keyBinding.credentialRef === undefined
-    ? DEFAULT_CREDENTIAL_REF
-    : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
-  if (!credentialPattern.test(credentialRef)) {
-    throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
-  }
-  if (legacyCredentialRefs({ id, provider: { id: providerID } }).includes(credentialRef)) credentialRef = DEFAULT_CREDENTIAL_REF
   if (!identityOnly && provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
-  const protocol = keyBinding.type ?? 'worker-user-center-v1'
-  if (!['worker-user-center-v1', 'eduwork-resources-v1'].includes(protocol)) throw new Error('profile.keyBinding.type is not supported')
-  const modelSource = provider.modelSource ?? 'profile'
-  if (!['profile', 'discovery'].includes(modelSource)) throw new Error('profile.provider.modelSource must be profile or discovery')
+  const modelSource = 'discovery'
   const scopes = oidc.scopes
-  if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
+  if (!gateway && (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope)))) {
     throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
   }
-  if (new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
+  if (!gateway && new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
   return Object.freeze({
     schemaVersion: PROFILE_SCHEMA_VERSION,
     id,
@@ -319,22 +319,16 @@ export function normalizeEnterpriseProfile(raw) {
     ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
     nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
     brand: normalizeBrand(source.brand),
-    oidc: Object.freeze({
+    ...(gateway ? { auth } : { oidc: Object.freeze({
       issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
-    }),
-    ...(identityOnly ? {} : { keyBinding: Object.freeze({
-      type: protocol,
-      baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
-      providerId: providerID,
-      credentialRef,
-    }),
-    provider: Object.freeze({
+    }) }),
+    ...(identityOnly ? {} : { provider: Object.freeze({
       id: providerID,
       displayName: text(provider.displayName ?? source.displayName, 'profile.provider.displayName', 120),
       adapter: provider.adapter,
-      baseURL: exactURL(provider.baseURL, 'profile.provider.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
+      baseURL: '',
       reasoning: provider.reasoning === undefined
         ? 'high'
         : (() => {
@@ -385,9 +379,9 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.models.length).map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.baseURL && profile.provider.models.length).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
-      apiKeyEnv: profile.keyBinding.credentialRef,
+      apiKeyEnv: `DSH_GATEWAY_${profile.id.toUpperCase().replace(/-/g, '_')}_ACCESS`,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
       ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
@@ -418,7 +412,7 @@ export function publicProfile(profile) {
     displayName: profile.displayName,
     organization: profile.organization,
     brand: profile.brand,
-    credentialRef: profile.keyBinding?.credentialRef ?? '',
+    credentialRef: '',
     ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,

package/lib/provider/authorization-scope.js

@@ -0,0 +1,46 @@
+/** Keep prepared calls, credential resolution and streamed results in one authorization. */
+export class AuthorizationScopedAdapter {
+  constructor(inner, storage, createScope) {
+    this.inner = inner
+    this.storage = storage
+    this.createScope = createScope
+  }
+
+  providerInfo(provider) { return this.inner.providerInfo(provider) }
+  providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
+  imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
+  listModels(provider) { return this.inner.listModels(provider) }
+  resolveModel(provider, model, signal) { return this.inner.resolveModel(provider, model, signal) }
+
+  async prepareCall(provider, model, signal) {
+    const scope = await this.createScope(provider)
+    const prepared = await this.inner.prepareCall(provider, model, signal)
+    return { model: prepared.model, stream: options => this.streamPrepared(prepared, options, scope) }
+  }
+
+  async * streamPrepared(prepared, options, scope) {
+    if (!scope) { yield* prepared.stream(options); return }
+    const lease = scope.open(options.signal)
+    let iterator
+    try {
+      lease.assertCurrent()
+      iterator = prepared.stream({ ...options, signal: lease.signal })[Symbol.asyncIterator]()
+      for (;;) {
+        lease.assertCurrent()
+        const next = await this.storage.run(lease, () => iterator.next())
+        // Even a transport that buffers or ignores abort must not emit stale data.
+        lease.assertCurrent()
+        if (next.done) return
+        yield next.value
+      }
+    } finally {
+      try { await this.storage.run(lease, () => iterator?.return?.()) }
+      finally { lease.close() }
+    }
+  }
+
+  async * stream(options) {
+    const prepared = await this.prepareCall(options.provider, options.model, options.signal)
+    yield* prepared.stream(options)
+  }
+}

package/lib/provider/index.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
 import { LlmError, assertUsableApiKey, resolveImageAttachmentAccess, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
 import { Config as PiAiConfig, PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
@@ -10,6 +11,7 @@ import {
 } from './core.js'
 import { TransformingEnterpriseAdapter } from './transform-adapter.js'
 import { EnterpriseModelTransforms } from './transforms.js'
+import { AuthorizationScopedAdapter } from './authorization-scope.js'
 
 export const name = 'dsh-oidc-provider'
 export const inject = ['llm']
@@ -108,6 +110,7 @@ export function resolveEnterpriseImageAccess(ctx, attachments, ref) {
 }
 
 export function apply(ctx, rawConfig = {}) {
+  const callAuthorization = new AsyncLocalStorage()
   const transforms = new EnterpriseModelTransforms(ctx)
   let current = () => settingsBase(rawConfig)
   let profiles = profilesFrom(current())
@@ -121,7 +124,10 @@ export function apply(ctx, rawConfig = {}) {
       }
       const ref = profile.apiKeyEnv
       const credentials = ctx.get('credentials')
-      const hit = typeof rawConfig.resolveCredential === 'function'
+      const lease = callAuthorization.getStore()
+      const hit = lease
+        ? (await lease.resolveCredential(provider))?.value
+        : typeof rawConfig.resolveCredential === 'function'
         ? (await rawConfig.resolveCredential(provider))?.value
         : credentials === undefined
         ? launchEnvironmentOf(ctx).get(ref)?.value
@@ -133,9 +139,12 @@ export function apply(ctx, rawConfig = {}) {
     resolveImageAccess: (attachments, ref) => resolveEnterpriseImageAccess(ctx, attachments, ref),
   })
 
-  const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
+  const transforming = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
     profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
   ))
+  const adapter = typeof rawConfig.createAuthorizationScope === 'function'
+    ? new AuthorizationScopedAdapter(transforming, callAuthorization, rawConfig.createAuthorizationScope)
+    : transforming
   let registration
   let directory
   const replaceProfiles = next => {

package/lib/typert-schemas.js

@@ -3,7 +3,7 @@ import { z } from 'zod'
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
 export const loginIdSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
-export const reconcileOptionsSchema = z.object({ allowProvision: z.boolean().optional() }).strict()
+export const reconcileOptionsSchema = z.object({}).strict()
 export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
 export const configurationTargetSchema = z.enum(['config', 'examples'])

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.2.4",
-  "description": "Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
+  "version": "0.3.0-dev.1",
+  "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
     "dsh",

package/protocol/openapi.yaml

@@ -1,257 +1,50 @@
 openapi: 3.1.0
 info:
-  title: dsh-oidc Worker User Center Key Binding API
+  title: EduWork Identity and Resource Protocol
   version: 1.0.0
   description: >-
-    The fixed worker-user-center-v1 protocol used by dsh-oidc to exchange an
-    OIDC Bearer access token for a short-lived or revocable model runtime
-    credential. Endpoint paths and wire field names are deliberately not
-    configurable. See docs/key-binding-protocol.md for normative requirements.
-  license:
-    name: MIT
-    identifier: MIT
+    Model discovery for a local single-user client with explicit gateway authorization.
+    Requests use the current Access Token. The client does not provision model API keys.
+    Quota and activity heartbeat remain optional institution extensions.
+  license: { name: MIT, identifier: MIT }
 servers:
-  - url: https://ai.example.edu/api/worker/v1
-    description: Example baseURL from an Enterprise Profile
+  - url: https://ai.example.edu/open/api/v1
 security:
-  - oidcAccessToken: []
+  - accessToken: []
 paths:
-  /bootstrap:
+  /models:
     get:
-      operationId: bootstrap
-      summary: Read subject-independent integration state and credential lifecycle state
+      operationId: listResourceModels
       responses:
         '200':
-          description: Current provider and runtime credential state
-          headers:
-            Cache-Control:
-              schema: { type: string }
-              description: MUST contain no-store
+          description: Available model identifiers; reviewed capabilities remain in the client Profile
           content:
             application/json:
-              schema: { $ref: '#/components/schemas/BootstrapResponse' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '403': { $ref: '#/components/responses/Forbidden' }
+              schema:
+                type: object
+                required: [data]
+                properties:
+                  data:
+                    type: array
+                    minItems: 1
+                    maxItems: 128
+                    items:
+                      type: object
+                      required: [id]
+                      properties:
+                        id: { type: string, minLength: 1, maxLength: 256 }
+        '401': { description: Access Token is invalid or expired }
+        '403': { description: Model discovery is not permitted }
+        '404': { description: Discovery endpoint is unavailable }
         '429': { $ref: '#/components/responses/RateLimited' }
-        '5XX': { $ref: '#/components/responses/ServerError' }
-  /runtime-credential/provision:
-    post:
-      operationId: provisionRuntimeCredential
-      summary: Provision and return a runtime credential for the authenticated subject
-      parameters:
-        - $ref: '#/components/parameters/IdempotencyKey'
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: { $ref: '#/components/schemas/RuntimeCredentialRequest' }
-      responses:
-        '200': { $ref: '#/components/responses/RuntimeCredential' }
-        '201': { $ref: '#/components/responses/RuntimeCredential' }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '403': { $ref: '#/components/responses/Forbidden' }
-        '409': { $ref: '#/components/responses/Conflict' }
-        '429': { $ref: '#/components/responses/RateLimited' }
-        '5XX': { $ref: '#/components/responses/ServerError' }
-  /runtime-credential/resolve:
-    post:
-      operationId: resolveRuntimeCredential
-      summary: Resolve the active runtime credential for the authenticated subject
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: { $ref: '#/components/schemas/RuntimeCredentialRequest' }
-      responses:
-        '200': { $ref: '#/components/responses/RuntimeCredential' }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '403': { $ref: '#/components/responses/Forbidden' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '429': { $ref: '#/components/responses/RateLimited' }
-        '5XX': { $ref: '#/components/responses/ServerError' }
-  /runtime-credential/renew:
-    post:
-      operationId: renewRuntimeCredential
-      summary: Rotate an expiring or expired runtime credential
-      parameters:
-        - $ref: '#/components/parameters/IdempotencyKey'
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              allOf:
-                - $ref: '#/components/schemas/RuntimeCredentialRequest'
-                - type: object
-                  required: [api_key_id]
-      responses:
-        '200': { $ref: '#/components/responses/RuntimeCredential' }
-        '201': { $ref: '#/components/responses/RuntimeCredential' }
-        '400': { $ref: '#/components/responses/BadRequest' }
-        '401': { $ref: '#/components/responses/Unauthorized' }
-        '403': { $ref: '#/components/responses/Forbidden' }
-        '404': { $ref: '#/components/responses/NotFound' }
-        '409': { $ref: '#/components/responses/Conflict' }
-        '429': { $ref: '#/components/responses/RateLimited' }
-        '5XX': { $ref: '#/components/responses/ServerError' }
+        '5XX': { $ref: '#/components/responses/Unavailable' }
 components:
-  securitySchemes:
-    oidcAccessToken:
-      type: http
-      scheme: bearer
-      bearerFormat: JWT or opaque OIDC access token
-      description: >-
-        Access token issued to the public OIDC client declared in the matching
-        Enterprise Profile. The server validates issuer, audience, expiry,
-        required scopes, and the authenticated subject.
-  parameters:
-    IdempotencyKey:
-      name: Idempotency-Key
-      in: header
-      required: true
-      description: Opaque UUID generated for one logical mutating operation.
-      schema:
-        type: string
-        format: uuid
-  schemas:
-    BootstrapResponse:
-      type: object
-      additionalProperties: false
-      required: [provider, capabilities, runtime_credential]
-      properties:
-        protocol_version:
-          type: string
-          enum: [worker.user-center.v1, worker-user-center/v1, eduwork-resources/v1]
-          description: Optional during v1 adoption; all three version labels share the deployed credential lifecycle wire.
-        subject:
-          $ref: '#/components/schemas/InformationalSubject'
-        provider:
-          type: object
-          additionalProperties: false
-          required: [id]
-          properties:
-            id:
-              type: string
-              pattern: '^[a-z][a-z0-9-]{0,63}$'
-        capabilities:
-          type: array
-          maxItems: 256
-          uniqueItems: true
-          items: { type: string, minLength: 1, maxLength: 128 }
-        runtime_credential:
-          $ref: '#/components/schemas/RuntimeCredentialState'
-    InformationalSubject:
-      type: object
-      additionalProperties: true
-      description: >-
-        Optional management-plane display data. dsh-oidc MUST NOT use it to
-        replace the identity established by the OIDC ID Token and UserInfo.
-      properties:
-        sub: { type: string }
-        name: { type: string }
-        affiliation: { type: string }
-    RuntimeCredentialState:
-      type: object
-      additionalProperties: false
-      required: [status]
-      properties:
-        status:
-          enum: [missing, active, expiring, expired, suspended, unavailable]
-        api_key_id:
-          type: string
-          minLength: 1
-          maxLength: 256
-        expires_at:
-          type: string
-          format: date-time
-        provisioning:
-          type: object
-          additionalProperties: false
-          properties:
-            allowed: { type: boolean }
-            reason: { type: string, maxLength: 500 }
-    RuntimeCredentialRequest:
-      type: object
-      additionalProperties: false
-      required: [provider_id]
-      properties:
-        provider_id:
-          type: string
-          pattern: '^[a-z][a-z0-9-]{0,63}$'
-        api_key_id:
-          type: string
-          minLength: 1
-          maxLength: 256
-    RuntimeCredentialResponse:
-      type: object
-      additionalProperties: false
-      required: [provider_id, api_key, status]
-      properties:
-        provider_id:
-          type: string
-          pattern: '^[a-z][a-z0-9-]{0,63}$'
-        api_key:
-          type: string
-          minLength: 1
-          maxLength: 16384
-          description: Secret value. It MUST appear only in this TLS response and MUST NOT be logged.
-        api_key_id:
-          type: string
-          minLength: 1
-          maxLength: 256
-        status:
-          const: active
-        expires_at:
-          type: string
-          format: date-time
-    Problem:
-      type: object
-      additionalProperties: true
-      required: [type, title, status]
-      properties:
-        type: { type: string, format: uri-reference }
-        title: { type: string }
-        status: { type: integer, minimum: 400, maximum: 599 }
-        detail: { type: string }
-        instance: { type: string, format: uri-reference }
-        code: { type: string, description: Stable machine-readable service code }
   responses:
-    RuntimeCredential:
-      description: Active runtime credential
-      headers:
-        Cache-Control:
-          schema: { type: string }
-          description: MUST contain no-store
-        Pragma:
-          schema: { type: string }
-          description: SHOULD be no-cache for compatibility
-      content:
-        application/json:
-          schema: { $ref: '#/components/schemas/RuntimeCredentialResponse' }
-    BadRequest:
-      description: Invalid request
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
-    Unauthorized:
-      description: Missing, invalid, expired, or wrong-audience access token
-      headers:
-        WWW-Authenticate: { schema: { type: string } }
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
-    Forbidden:
-      description: Authenticated subject lacks the required scope or organization entitlement
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
-    NotFound:
-      description: Requested runtime credential does not exist
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
-    Conflict:
-      description: Idempotency conflict or incompatible credential lifecycle state
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
     RateLimited:
-      description: Rate limit exceeded
+      description: Temporarily limited; current client reports unavailable and allows a later manual refresh
       headers:
-        Retry-After: { schema: { type: string } }
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
-    ServerError:
-      description: Server-side failure with no secret material
-      content: { application/problem+json: { schema: { $ref: '#/components/schemas/Problem' } } }
+        Retry-After: { schema: { type: string }, description: Seconds or HTTP date for a future retry; never a refresh-token grant }
+    Unavailable:
+      description: Temporary resource failure; do not clear identity or the model key
+  securitySchemes:
+    accessToken: { type: http, scheme: bearer, description: Model runtime credential }

package/protocol/resources.openapi.yaml

@@ -3,15 +3,14 @@ info:
   title: EduWork Identity and Resource Protocol
   version: 1.0.0
   description: >-
-    Optional resource integration for a local single-user OIDC client.
-    Management uses worker-user-center-v1 bootstrap and credential operations. Quota and activity heartbeat are institution extensions, absent from this contract.
-    Model discovery uses the resulting runtime API key, never the
-    identity token. Pure OIDC deployments may omit resource integration.
+    Model discovery for a local single-user client with explicit gateway authorization.
+    Requests use the current Access Token. The client does not provision model API keys.
+    Quota and activity heartbeat remain optional institution extensions.
   license: { name: MIT, identifier: MIT }
 servers:
   - url: https://ai.example.edu/open/api/v1
 security:
-  - runtimeKey: []
+  - accessToken: []
 paths:
   /models:
     get:
@@ -34,9 +33,9 @@ paths:
                       required: [id]
                       properties:
                         id: { type: string, minLength: 1, maxLength: 256 }
-        '401': { description: Runtime key is invalid or expired }
-        '403': { description: Model discovery is not permitted; keep the reviewed catalog }
-        '404': { description: Discovery not supported; client keeps reviewed model catalog }
+        '401': { description: Access Token is invalid or expired }
+        '403': { description: Model discovery is not permitted }
+        '404': { description: Discovery endpoint is unavailable }
         '429': { $ref: '#/components/responses/RateLimited' }
         '5XX': { $ref: '#/components/responses/Unavailable' }
 components:
@@ -48,4 +47,4 @@ components:
     Unavailable:
       description: Temporary resource failure; do not clear identity or the model key
   securitySchemes:
-    runtimeKey: { type: http, scheme: bearer, description: Model runtime credential }
+    accessToken: { type: http, scheme: bearer, description: Model runtime credential }