Module credentials 

C1: credentials contract for deployer env-packs.

Every deployer env-pack ships a DeployerCredentials implementation that declares what capabilities its credentials must satisfy and how to probe them. Phase A’s CLI surface (gtc op credentials …) drives this contract through the env-pack registry — requirements validates against the bound deployer, bootstrap runs the deployer’s bootstrap path.

Admin credentials are never intentionally persisted. The ZeroizedAdmin wrapper zeroizes its in-process buffer on drop where the language/runtime allows it. The contract is honest about what it cannot guarantee: process-wide memory erasure is impossible (the OS may have paged the buffer, the cloud SDK may hold its own copy, ambient profile chains live outside our control). Callers should run on short-lived processes when this matters.

Phase A constraint

Env-pack handlers are metadata-only in Phase A (see env_packs::slot) — there is no wired secrets backend yet. Probes that need credential material (reading a key from AWS-SM, calling AWS STS) cannot run today; impls report CapabilityStatus::Skipped for those entries instead of panicking. Local-process credentials work today because they probe only the local environment (filesystem writability, port availability) and need no credential material at all (C2).

Re-exports

pub use bootstrap::BootstrapError;

pub use bootstrap::BootstrapInput;

pub use bootstrap::BootstrapOutcome;

pub use bootstrap::BoundSecretSink;

pub use bootstrap::RunBootstrapError;

pub use bootstrap::ZeroizedAdmin;

pub use bootstrap::run_bootstrap;

pub use rotate::RotateOutcome;

pub use rotate::RunRotateError;

pub use rotate::run_rotate;

pub use rules_export::RulesExportError;

pub use rules_export::RulesPack;

pub use rules_export::RulesPackEntry;

pub use rules_export::write_rules_pack;

pub use validate::Capability;

pub use validate::CapabilityCheck;

pub use validate::CapabilityStatus;

pub use validate::RequirementsReport;

pub use validate::ValidateError;

pub use validate::ValidationContext;

pub use validate::validate_requirements;

Modules

bootstrap

Bootstrap-flow driver for super::DeployerCredentials.

rotate

Rotation-flow driver for super::DeployerCredentials.

rules_export

Rules-pack writer for the bootstrap flow.

validate

Requirements-flow driver for super::DeployerCredentials.

Traits

DeployerCredentials

Contract a deployer env-pack handler implements to surface its credentials story to the gtc op credentials CLI.