@nylorun/runtime 0.32.0-beta → 0.34.0-beta

package/dist/gates/egress.d.ts

@@ -3,17 +3,23 @@ import { type Socket } from "node:net";
 import type { EgressRunningTurn, AgentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
+import type { CredentialProvider } from "./credential-provider.js";
 import type { Logger } from "../tenant/types.js";
 import { type EgressCredentials } from "./egress-credentials.js";
 /**
  * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
  * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
+ * For an Agent with an owner guard, also the owner and the Tenant's egress ceiling
+ * (`environments.config`'s `limits.network`) when the Tenant sets one: what the credential
+ * provider is asked about and kept inside.
  */
 export interface EgressSandboxes {
     live(sandboxId: string): Promise<{
         readonly epoch: number;
         readonly podUid?: string;
         readonly allow: readonly string[];
+        readonly owner?: string;
+        readonly ceiling?: readonly string[];
     } | undefined>;
 }
 /** One connection's record (R7.3, D67): `agent.egress`'s payload. */
@@ -63,6 +69,11 @@ export interface StartEgressGateOptions {
     readonly credentials?: EgressCredentials;
     /** Where connections are recorded (R7.3). None: they are only logged. */
     readonly record?: EgressRecord;
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_URL`): the hosts it lists for an
+     * Agent's owner pass on 443 and are handed to it. Needs `credentials` (the leaf). None: off.
+     */
+    readonly provider?: CredentialProvider;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */
@@ -84,7 +95,9 @@ export declare function startEgressGate(options: StartEgressGateOptions): Promis
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * Environment, or one deleted or lost, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token. An Agent with an
+ * owner guard also gets its owner and, when the Tenant sets one, its egress ceiling (one more
+ * read, of the Tenant's `environments.config`).
  */
 export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;
 /**

package/dist/gates/egress.js

@@ -11,17 +11,21 @@
  * 2. its sandbox is live and its host epoch and pod are the token's (`EgressSandboxes.live`),
  *    else 407;
  * 3. the port is 443 or 80, the target is a host name and no IP literal, and it matches the spec's
- *    `network.allow` exactly or by `*.suffix`, else 403;
+ *    `network.allow` exactly or by `*.suffix`, or (443 only) the outside credential provider lists
+ *    it for the Agent's owner and the Tenant's egress ceiling holds it, else 403;
  * 4. the sandbox has fewer than `maxPerSandbox` tunnels open, else 429;
  * 5. the name resolves, and to at least one address that is not private, loopback, link-local
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
- * A tunnel is opaque bytes, with one exception (R2c, D50): port 443 of a host that an
+ * A tunnel is opaque bytes, with two exceptions. First (R2c, D50): port 443 of a host that an
  * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
  * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
- * only to the checked address. Every other host gets the tunnel. Any other request
- * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged; the token
+ * only to the checked address. Second, port 443 of a host the credential provider lists
+ * (`credential-provider.ts`) and no secret binds: terminated the same way, its requests are handed
+ * to the provider's forward route, which adds the key; the vault's binding wins where both apply.
+ * Every other host gets the tunnel. Any other request (an absolute-form plain HTTP request
+ * included) is answered 405. Refusals are logged; the token
  * never is. Tunnels close after `idleMs` without traffic in either direction.
  *
  * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
@@ -40,6 +44,8 @@ import { createServer } from "node:http";
 import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
+import { readSandboxConfig } from "../sandbox/tenant-config.js";
+import { withinCeiling } from "../sandbox/resolve.js";
 import { bindListener } from "../host/http.js";
 import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
@@ -212,8 +218,25 @@ export async function startEgressGate(options) {
         return value;
     }
     const terminator = options.credentials
-        ? credentialTerminator({ credentials: options.credentials, logger, idleMs })
+        ? credentialTerminator({
+            credentials: options.credentials,
+            logger,
+            idleMs,
+            ...(options.provider ? { provider: options.provider } : {}),
+        })
         : undefined;
+    const provider = terminator ? options.provider : undefined;
+    /**
+     * Whether the credential provider lists `host` for the sandbox's owner, inside the Tenant's
+     * ceiling: only on 443, where the gate terminates TLS, and never for an Agent without an owner.
+     */
+    async function providerLists(sandboxId, sandbox, host, port) {
+        if (!provider || port !== 443 || sandbox.owner === undefined)
+            return false;
+        if (sandbox.ceiling && !withinCeiling(host, sandbox.ceiling))
+            return false;
+        return (await provider.hosts(sandboxId, sandbox.owner)).includes(host);
+    }
     const open = new Map();
     const tunnels = new Set();
     /** Each connection's record, once its Environment and target are known. */
@@ -257,7 +280,9 @@ export async function startEgressGate(options) {
             return refuse(403, "port_refused", { sandboxId }, `port ${port} is not allowed; tunnels open to 443 or 80 only`);
         if (isIP(host.replace(/^\[|\]$/g, "")) !== 0 || !isSandboxHostPattern(host) || host.startsWith("*."))
             return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
-        if (!egressAllows(host, sandbox.allow))
+        // A host the provider lists goes to it, even one the spec allows, unless the vault binds it.
+        const provided = await providerLists(sandboxId, sandbox, host, port);
+        if (!provided && !egressAllows(host, sandbox.allow))
             return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
         // The turns running on the Environment as the connection opens: the read starts as the
         // name resolves, and the 200 does not wait for it.
@@ -298,6 +323,20 @@ export async function startEgressGate(options) {
             client.once("close", () => record.closed(tally));
             return terminator.terminate(client, { sandboxId, host, addresses: allowed, tally });
         }
+        if (terminator && provided && sandbox.owner !== undefined) {
+            record.credentialBound = true;
+            if (head.length > 0)
+                return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
+            const tally = { requests: 0, credentialIds: new Set() };
+            client.once("close", () => record.closed(tally));
+            return terminator.terminate(client, {
+                sandboxId,
+                host,
+                addresses: allowed,
+                tally,
+                provider: { agentId: sandboxId, owner: sandbox.owner },
+            });
+        }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
             return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);
@@ -383,6 +422,7 @@ export async function startEgressGate(options) {
                 for (const tunnel of tunnels)
                     tunnel.destroy();
                 server.closeAllConnections();
+                terminator?.close();
             });
             return closing;
         },
@@ -391,23 +431,31 @@ export async function startEgressGate(options) {
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * Environment, or one deleted or lost, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token. An Agent with an
+ * owner guard also gets its owner and, when the Tenant sets one, its egress ceiling (one more
+ * read, of the Tenant's `environments.config`).
  */
 export function storeEgressSandboxes(store) {
     return {
         async live(sandboxId) {
-            const sandbox = await store.tx((t) => t.environment(sandboxId));
-            const pod = sandbox?.pod;
-            if (!sandbox || sandbox.kind !== "pod" || !pod)
-                return undefined;
-            if (pod.desired === "deleted" || pod.observed === "lost")
-                return undefined;
-            return {
-                epoch: pod.hostEpoch,
-                ...(pod.podUid ? { podUid: pod.podUid } : {}),
-                // The applied allowlist: a recipe change writes it at once (Q8).
-                allow: sandbox.applied.network?.allowedHosts ?? [],
-            };
+            return store.tx(async (t) => {
+                const sandbox = await t.environment(sandboxId);
+                const pod = sandbox?.pod;
+                if (!sandbox || sandbox.kind !== "pod" || !pod)
+                    return undefined;
+                if (pod.desired === "deleted" || pod.observed === "lost")
+                    return undefined;
+                const owner = sandbox.ownerUserId;
+                const ceiling = owner === undefined ? undefined : (await readSandboxConfig(t)).limits?.network;
+                return {
+                    epoch: pod.hostEpoch,
+                    ...(pod.podUid ? { podUid: pod.podUid } : {}),
+                    // The applied allowlist: a recipe change writes it at once (Q8).
+                    allow: sandbox.applied.network?.allowedHosts ?? [],
+                    ...(owner === undefined ? {} : { owner }),
+                    ...(ceiling === undefined ? {} : { ceiling }),
+                };
+            });
         },
     };
 }

package/dist/gates/handler.js

@@ -23,8 +23,8 @@ export function createModelCallHandler(options) {
                 request = call;
                 const gate = inProcessModelGate({
                     root: vault.root,
-                    readHostModel: () => vault.readHostModel(),
-                    writeHostCredential: (credential) => vault.writeHostCredential(credential),
+                    readHostModel: (request) => vault.readHostModel(request.sessionId),
+                    writeHostCredential: (credential, provider) => vault.writeHostCredential(credential, provider),
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),

package/dist/gates/in-process.d.ts

@@ -15,9 +15,10 @@ import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
-    readonly readHostModel: () => Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    readonly writeHostCredential: (credential: Credential) => Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readonly readHostModel: (request: ModelGateRequest) => Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, the one the call read. */
+    readonly writeHostCredential: (credential: Credential, provider: string) => Promise<void>;
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;

package/dist/gates/in-process.js

@@ -45,8 +45,8 @@ export function tenantModelGate(options) {
             // The Tenant's Runtime limits `model*`, read for this call.
             const gate = inProcessModelGate({
                 root: options.root,
-                readHostModel: () => vault.readHostModel(),
-                writeHostCredential: (credential) => vault.updateHostCredential(credential),
+                readHostModel: (request) => vault.readHostModel(request.sessionId),
+                writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
                 caller: callCaller(options.store),
@@ -71,11 +71,17 @@ export async function serve(store, gate, request, signal) {
 export function inProcessModelGate(options) {
     return {
         async call(request, signal) {
-            // One adapter per call, as before the gate: it reads the host model when invoked.
+            // One adapter per call, as before the gate: it reads the host model when invoked, and a
+            // refreshed credential goes back to the provider it read.
+            let provider;
             const adapter = piModel({
                 ...(options.root !== undefined ? { root: options.root } : {}),
-                readHostModel: options.readHostModel,
-                writeHostCredential: options.writeHostCredential,
+                readHostModel: async () => {
+                    const stored = await options.readHostModel(request);
+                    provider = stored?.provider;
+                    return stored;
+                },
+                writeHostCredential: (credential) => options.writeHostCredential(credential, provider),
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
                 ...(options.caller ? { caller: () => options.caller(request) } : {}),

package/dist/gates/tenant-vaults.d.ts

@@ -22,9 +22,10 @@ export interface TenantVault {
     readonly store: SessionStore;
     /** The Tenant's home: secrets found there are redacted from failure messages. */
     readonly root: string;
-    readHostModel(): Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    writeHostCredential(credential: Credential): Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readHostModel(sessionId?: string): Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, else the active one's. */
+    writeHostCredential(credential: Credential, provider?: string): Promise<void>;
     /** A session, for the remote MCP servers and HTTP tools its pinned manifest declares. */
     session(sessionId: string): Promise<Session | undefined>;
     /**

package/dist/gates/tenant-vaults.js

@@ -47,8 +47,8 @@ export function createTenantVaults(options) {
             tenantId,
             store,
             root: paths.home,
-            readHostModel: () => vault.readHostModel(),
-            writeHostCredential: (credential) => vault.updateHostCredential(credential),
+            readHostModel: (sessionId) => vault.readHostModel(sessionId),
+            writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,

package/dist/harness-api/start.js

@@ -4,8 +4,13 @@
  * outcomes are read; then the transcript is folded from the record (P0.3). `buildTurnStart`
  * turns that into the run's `turn.start`: the checkpoint goes without its transcript, which the
  * harness holds at the fold's cursor or reads once.
+ *
+ * A pod Agent's sandbox variables are its vault's (R2c), then, with an outside credential
+ * provider (`gates/credential-provider.ts`) and an owner on the Agent, each variable the provider
+ * names for that owner, set to the stand-in `nylorun_managed` and never over a vault variable.
+ * The provider is asked after the transaction, and one that fails adds nothing.
  */
-import { harnessLimitsOf } from "@nylorun/core/contracts";
+import { ENVIRONMENT_SECRET_SENTINEL, harnessLimitsOf } from "@nylorun/core/contracts";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { isWorkflowManifest } from "../core/flow-host.js";
 import { sandboxWorkspaceOf } from "../sandbox/share.js";
@@ -33,6 +38,8 @@ options = {}) {
     const id = lease.sessionId;
     // Read before the transaction: the first read of the Tenant may create the key.
     const key = options.harness ? await traceKey(ctx.store) : undefined;
+    // The pod Agent and its owner the credential provider is asked about, once the transaction ends.
+    let providerAsk;
     const opened = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
         // A turn's first segment runs the version its Agent runs now (T3, D73).
         if (options.harness && (await repinTurn(t, current)))
@@ -52,6 +59,10 @@ options = {}) {
         const workspace = sandboxWorkspaceOf(current);
         const resource = workspace.environmentId === undefined ? undefined : await t.environment(workspace.environmentId);
         const environment = await ctx.vault.environmentVariables(t, current.environmentId);
+        providerAsk =
+            ctx.credentialProvider && resource?.kind === "pod" && resource.ownerUserId
+                ? { agentId: resource.id, owner: resource.ownerUserId }
+                : undefined;
         const sandbox = {
             ...workspace,
             ...(Object.keys(environment).length > 0 ? { environment } : {}),
@@ -82,9 +93,10 @@ options = {}) {
     });
     // The model an agent's harness decides files by, read outside the session's transaction.
     const model = options.harness && !isWorkflowManifest(opened.current.manifest)
-        ? await currentModelDescriptor(ctx)
+        ? await currentModelDescriptor(ctx, opened.current.model)
         : undefined;
-    const started = model ? { ...opened, model } : opened;
+    const provided = await withProviderVariables(ctx, opened, providerAsk);
+    const started = model ? { ...provided, model } : provided;
     // One history (P0.3): the engine resumes from the transcript folded from the record.
     const { current } = started;
     const cp = current.checkpoint;
@@ -101,6 +113,21 @@ options = {}) {
     checkParity(id, transcript, transcriptOf(cp.state));
     return { ...started, transcript, cursor };
 }
+/**
+ * `opened` with the credential provider's variables for `ask` added to its sandbox's environment
+ * as the stand-in, under the vault's own; `opened` itself when there are none.
+ */
+async function withProviderVariables(ctx, opened, ask) {
+    if (!ask || !ctx.credentialProvider)
+        return opened;
+    const names = await ctx.credentialProvider.environment(ask.agentId, ask.owner);
+    const vault = opened.sandbox.environment ?? {};
+    const added = names.filter((name) => !Object.hasOwn(vault, name));
+    if (added.length === 0)
+        return opened;
+    const environment = { ...Object.fromEntries(added.map((name) => [name, ENVIRONMENT_SECRET_SENTINEL])), ...vault };
+    return { ...opened, sandbox: { ...opened.sandbox, environment } };
+}
 /** The run's `turn.start`. */
 export function buildTurnStart(ctx, segment) {
     const { current } = segment;

package/dist/host/gates.d.ts

@@ -20,6 +20,7 @@ import type { PostgresClient } from "../store/postgres/connect.js";
 import type { Logger } from "../tenant/types.js";
 import type { EgressConfig, GatesConfig } from "./stack-config.js";
 import { type EgressGate, type StartEgressGateOptions } from "../gates/egress.js";
+import { type CredentialProviderSettings } from "../gates/credential-provider.js";
 export interface StartGatesOptions {
     readonly gates: GatesConfig;
     readonly logger: Logger;
@@ -71,10 +72,16 @@ export interface StartEgressOptions {
     readonly vaults?: TenantVaults;
     /** Replaces how sandboxes are read, and the gate's limits and hooks (tests). */
     readonly gate?: Partial<Omit<StartEgressGateOptions, "listen" | "logger" | "verify">>;
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_*`, Host feature
+     * `credential-provider`): the hosts it lists for an Agent's owner are handed to it.
+     */
+    readonly credentialProvider?: CredentialProviderSettings;
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
  * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
- * also records each connection (R7.3).
+ * also records each connection (R7.3). With a credential provider, the hosts it lists for an
+ * Agent's owner are terminated and handed to it.
  */
 export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -30,6 +30,7 @@ import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from ".
 import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
+import { createCredentialProvider } from "../gates/credential-provider.js";
 import { hostTuning } from "../tuning.js";
 export async function startGates(options) {
     const { gates, logger, database } = options;
@@ -159,7 +160,8 @@ export async function startGates(options) {
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
  * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
- * also records each connection (R7.3).
+ * also records each connection (R7.3). With a credential provider, the hosts it lists for an
+ * Agent's owner are terminated and handed to it.
  */
 export async function startEgress(options) {
     const { database } = options;
@@ -194,6 +196,9 @@ export async function startEgress(options) {
                 return { key: pair.privateKey, cert };
             },
         },
+        ...(options.credentialProvider
+            ? { provider: createCredentialProvider(options.credentialProvider, { logger: options.logger }) }
+            : {}),
         ...options.gate,
     });
 }

package/dist/host/main.js

@@ -63,8 +63,10 @@ import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
+import { createCredentialProvider } from "../gates/credential-provider.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useHostIdentity } from "../vault/host-identity.js";
 import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
@@ -168,6 +170,7 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
+        ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider.url } : {}),
     });
     warnRemovedSettings(stack, logger);
     const database = createDatabase(stack);
@@ -188,7 +191,13 @@ async function runGates(stack) {
             logger.info("gates_ready", { url: server.url });
         }
         if (stack.egress) {
-            const egress = await startEgress({ egress: stack.egress, database, hostRoot: resolveHostRoot(), logger });
+            const egress = await startEgress({
+                egress: stack.egress,
+                database,
+                hostRoot: resolveHostRoot(),
+                logger,
+                ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider } : {}),
+            });
             servers.push(egress);
             logger.info("egress_ready", { url: egress.url });
         }
@@ -220,6 +229,7 @@ export async function main() {
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
     useWorkloadToken(stack.workloadToken ?? {});
+    useHostIdentity(stack.modelHostIdentity ?? []);
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))
@@ -269,6 +279,7 @@ export async function main() {
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "fs",
         traces: stack.traces?.export ? "otlp" : "off",
+        ...(stack.credentialProvider ? { credentialProvider: stack.credentialProvider.url } : {}),
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -375,6 +386,10 @@ export async function main() {
             harnessImage: stack.sandboxes.harnessImage,
         }
         : undefined;
+    // The outside credential provider: each pod Agent segment's variables it names (CP-E).
+    const credentialProvider = stack.credentialProvider
+        ? createCredentialProvider(stack.credentialProvider, { logger })
+        : undefined;
     const tenantSettings = stack.tenant ?? { name: "default" };
     const module = createTenantModule({
         open: createPostgresTenantOpener({
@@ -402,6 +417,7 @@ export async function main() {
                 ...(blobs ? { blobs } : {}),
                 ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
                 ...(pods ? { pods } : {}),
+                ...(credentialProvider ? { credentialProvider } : {}),
                 ...(stack.traces
                     ? { traces: { resource: stack.traces.resource, content: new Set(stack.traces.content) } }
                     : {}),

package/dist/host/stack-config.d.ts

@@ -42,7 +42,9 @@
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
- * retries and internal sizes.
+ * retries and internal sizes. So is the outside credential provider
+ * (`NYLORUN_CREDENTIAL_PROVIDER_URL`, `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`), for egress-gate and
+ * a process running core or loop (`gates/credential-provider.ts`).
  */
 import { type TraceResource } from "../traces/otlp.js";
 import { type TraceContentKind } from "../traces/map.js";
@@ -188,6 +190,20 @@ export interface StackConfig {
         file?: string;
         origins?: string[];
     };
+    /**
+     * `NYLORUN_MODEL_HOST_IDENTITY`: the comma-separated providers whose models may use the Host's
+     * own identity (ADR-71, `vault/host-identity.ts`). Absent: none.
+     */
+    modelHostIdentity?: string[];
+    /**
+     * `NYLORUN_CREDENTIAL_PROVIDER_URL` and `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`, for a process running
+     * egress, core or loop (Host feature `credential-provider`): the outside service egress-gate
+     * hands an Agent owner's connected hosts to, and core asks for their variables. Absent: none.
+     */
+    credentialProvider?: {
+        url: string;
+        token: string;
+    };
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -42,7 +42,9 @@
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
- * retries and internal sizes.
+ * retries and internal sizes. So is the outside credential provider
+ * (`NYLORUN_CREDENTIAL_PROVIDER_URL`, `NYLORUN_CREDENTIAL_PROVIDER_TOKEN`), for egress-gate and
+ * a process running core or loop (`gates/credential-provider.ts`).
  */
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
@@ -50,6 +52,7 @@ import { isTenantId } from "@nylorun/core/compatibility";
 import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
+import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -327,6 +330,8 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const workloadToken = parseWorkloadToken(env);
+    const modelHostIdentity = parseModelHostIdentity(env);
+    const credentialProvider = servesApi || services.has("egress") ? parseCredentialProvider(env) : undefined;
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -350,6 +355,8 @@ export function parseStackConfig(env, argv) {
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(workloadToken ? { workloadToken } : {}),
+        ...(modelHostIdentity ? { modelHostIdentity } : {}),
+        ...(credentialProvider ? { credentialProvider } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -468,6 +475,45 @@ function parseWorkloadToken(env) {
         return undefined;
     return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
 }
+/** `StackConfig.modelHostIdentity` (ADR-71): each a provider that can use the Host's identity. */
+function parseModelHostIdentity(env) {
+    const raw = read(env, "NYLORUN_MODEL_HOST_IDENTITY");
+    if (raw === undefined)
+        return undefined;
+    const providers = [...new Set(raw.split(",").map((item) => item.trim()).filter((item) => item !== ""))];
+    for (const provider of providers) {
+        if (!HOST_IDENTITY_PROVIDERS.includes(provider))
+            throw new StackConfigError(`NYLORUN_MODEL_HOST_IDENTITY: ${provider} can't use the Host's identity (only ${HOST_IDENTITY_PROVIDERS.join(", ")})`);
+    }
+    return providers.length ? providers : undefined;
+}
+/**
+ * `StackConfig.credentialProvider`: the provider's `http` or `https` base URL (no credentials,
+ * query or fragment; `http` is for a provider on the Docker bridge or the machine itself) and its
+ * token, each required with the other.
+ */
+function parseCredentialProvider(env) {
+    const raw = read(env, "NYLORUN_CREDENTIAL_PROVIDER_URL");
+    const token = read(env, "NYLORUN_CREDENTIAL_PROVIDER_TOKEN");
+    if (raw === undefined && token === undefined)
+        return undefined;
+    if (raw === undefined)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN is set without NYLORUN_CREDENTIAL_PROVIDER_URL: set the provider's base URL, such as http://172.17.0.1:18793/edge/provider");
+    if (token === undefined)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN is required with NYLORUN_CREDENTIAL_PROVIDER_URL: the bearer the provider accepts");
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new StackConfigError(`NYLORUN_CREDENTIAL_PROVIDER_URL is not a URL: ${raw}`);
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password || url.search || url.hash)
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_URL must be an http or https base URL with no credentials, query or fragment, such as http://172.17.0.1:18793/edge/provider");
+    if (token.length < 16 || !/^[\x21-\x7e]+$/.test(token))
+        throw new StackConfigError("NYLORUN_CREDENTIAL_PROVIDER_TOKEN must be at least 16 printable characters with no spaces");
+    return { url: `${url.origin}${url.pathname}`.replace(/\/+$/, ""), token };
+}
 /** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
 function parseOrigins(raw) {
     if (raw === undefined)