Ingests the credential-injection pattern the microVM-sandbox field converged on
(Notion's Workers run on Vercel Firecracker microVMs with network-level
credential injection), and adds the two things that pattern ships without: the
secret held only by REFERENCE, and an audit commitment — both bound into the
Sandbox standard's existing capability model.
A NetworkGrant may now carry `credentials: Vec<EgressCredential>`. Each names an
authorized egress `endpoint`, a `secret_ref` HANDLE the enforcement boundary
resolves in its own keystore OUTSIDE the sandbox, and an `Injection` mode
(Bearer / Header / Query / BasicAuth) describing how the resolved secret is
applied to the request. The unit makes authenticated calls without ever holding
the key: a compromised or hallucinating agent inside the sandbox cannot read,
log, or exfiltrate a credential it was never given. The grant — and any receipt
over it — carries only the reference, never the material.
Two invariants:
- injection ⊆ egress. `Enforcer::credential_for(endpoint)` returns a credential
only when the endpoint is BOTH on the egress allowlist and has a declared
credential, so injection can never reach further than egress even if the grant
is malformed. `NetworkGrant::injection_within_egress()` flags such a grant at
mint time; the enforcer is defensive regardless.
- reference, not value. `EgressCredential::commitment()` content-addresses the
(endpoint, secret_ref, mode) decision, so an attestation can record WHICH
credential was injected for WHICH call without exposing the secret — the audit
primitive Notion/Vercel lack.
Backward compatible: `credentials` skips serialization when empty, so a grant
with none is byte-identical to one minted before the field existed. The
published sandbox conformance vectors are unchanged and still verify (empty
credential set omitted; asserted by test).
Five tests: injection only for authorized egress; injection can never exceed
egress even for a malformed grant; the reference is recorded while no secret
material ever appears in the encoding; commitments distinguish credentials
without the secret; empty sets are omitted. sandbox-capability clippy-clean; full
sandbox workspace green (one pre-existing warning in sandbox-conformance/vectors.rs,
unrelated and untouched).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
b0559f3e0d