Development record
The oracle and credential machine layer is whatever $HOME names: layered.RootsFor (internal/core/layered/layered.go:156) and credential.UserStore (internal/core/credential/store.go:92) both take os.UserHomeDir, which on Unix returns $HOME. An environment a repository can shape (a committed harness settings file whose env block sets HOME into the tree) would let a checkout supply the 'machine' ~/.abcd/config.json, and with it a keyed provider block and the machine routes that keyRoutes admits to spend a key, while the operating-system keychain still answers by the user's login session, so the repository's own route reaches the person's paid key through a machine layer it wrote. keyRoutes did not introduce this; it inherits the trust in $HOME.
The oracle and credential machine layer is whatever $HOME names: layered.RootsFor (internal/core/layered/layered.go:156) and credential.UserStore (internal/core/credential/store.go:92) both take os.UserHomeDir, which on Unix returns $HOME. An environment a repository can shape (a committed harness settings file whose env block sets HOME into the tree) would let a checkout supply the 'machine' ~/.abcd/config.json, and with it a keyed provider block and the machine routes that keyRoutes admits to spend a key, while the operating-system keychain still answers by the user's login session, so the repository's own route reaches the person's paid key through a machine layer it wrote. keyRoutes did not introduce this; it inherits the trust in $HOME.
Frontmatter
| id | iss-2609300012273350 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609300012273350-the-oracle-and-credential-machine-layer.md
open on GitHub ↗ · commit history ↗
mentions2
- itd-2609081951381895abcd ships an OpenAI-compatible API adapter, and a provider serves only the models it lists
- itd-2609301918174237A remote provider takes a file-reading agent only as a fixed, blanked, capped bundle