External access and credentials

Current status: partial catalog, authenticated control, and model-access foundations. Project-bound Connections, typed provider adapters, a fixed-route HTTPS executor, and fail-closed exact-generation listener custody have local tests. The executor is not connected to an authorized Cell-origin path. Integrated model inference, provider-only egress, and external consequence execution remain unavailable.

A Connection names an approved external identity and credential source. Gateway uses that authority outside the Agent Cell. The agent requests a typed operation and receives a bounded result and receipt, rather than a token.

Connection catalog and credential resolver

A logical ID such as org/github-production records provider, owner, allowed operations, resource scopes, status, version, and a credential reference. Policies and agents refer to this stable ID. An administrator can rotate its backing credential or provider without changing the agent or policy source.

Credential resolution may use an OS keychain, encrypted Cella storage, Vault or another secret manager, workload identity, or provider-native dynamic authority. Short-lived tokens, workload federation, delegated signing, and dynamic secrets are preferred to reusable static credentials.

Connections have explicit active, disabled, rotating, and revoked states. Disable blocks new resolution and invalidates queued Effects and active capabilities. Renewal evaluates current policy again.

Model routes and typed connectors

A model route injects provider authentication only after a request leaves the Cell. Typed connectors cover approved GitHub, package, document, cloud, and Virtus operations. Arbitrary authenticated HTTP and a shell with credentials are not capability substitutes.

A grant binds organization, repository, Workstream, Run, Cell generation, Connection version, operation, resource, destination, parameter and candidate digests, budget, approval, and expiry. Cross-Run, cross-destination, stale, replayed, altered, disabled, or revoked requests fail closed.

Results have allowlisted bounded schemas, size limits, and redaction. Credential material must not enter agent memory, environment, files, process listings, prompts, output, logs, checkpoints, snapshots, artifacts, evidence, or control responses. Error and crash paths are part of that requirement.

Example external operation

Agent requests github.propose_change(candidate_digest, repository)
  -> cellad authenticates identity and evaluates policy
  -> deny, allow, or require approval for the exact digest
  -> Gateway resolves the authorized Connection outside the Cell
  -> execute exact operation and destroy or revoke temporary authority
  -> return redacted result and attributable receipt

The receipt binds Connection version, policy digest, request digest, and result digest. Retry must reconcile the operation instead of creating another external consequence. See credentialed effect flow and Approvals and external actions.