Module spawn_credential 

The two secrets a delegated spawn travels on, and the headers they travel in.

mur-roost mints both; the runtime carries them and presents them. They live here, in the crate both sides already depend on, so the daemon and its one client read a single definition of each header name rather than two string literals that can drift apart.

• A credential names the session that holds it. It is minted once, when a session whose manifest declares capabilities.spawn.allow is staged, and it is what makes a spawn request answerable at all — the daemon judges the session the credential names, never the one a request body claims.
• An approval names one resolved artifact, for one session, for one launch. It is what POST /delegate returns and what POST /spawn redeems.

Both are opaque to this crate. Neither type parses, compares or validates what it holds: the authority that minted a token is the only thing that can read it, and everything here exists to make the string hard to spill on the way there.

Neither implements Display or Serialize, and both print redacted under Debug. A token reaches a trace, a log line or a tool result the moment one of those exists — the formatting call site does not have to be about the token for the token to end up in the record. Reading one takes the deliberate step of calling SpawnCredential::expose or SpawnApproval::expose, and those have exactly one call site each: delegation_plane::DelegationPlane::delegate, which puts the credential in one request header, and child_launch::launch_child_capsule, which writes the approval to one closed pipe.

Structs

SpawnApproval

The opaque, single-use token that names one approved launch of one resolved artifact.

SpawnCredential

The opaque, per-session token that proves which session is asking.

Constants

SPAWN_APPROVAL_HEADER

Request header carrying the approval a POST /delegate returned. Required on any POST /spawn other than the operator’s own top-level path.

SPAWN_CREDENTIAL_HEADER

Request header carrying the credential that names the calling session. Required on POST /delegate and on any POST /spawn that redeems an approval.