Skip to content

docs(adr): record agent credential gateway input in ADR 0009 #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wstein merged 1 commit into from
Oct 16, 2026
Merged

docs(adr): record agent credential gateway input in ADR 0009 #96

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion docs/adr/0009-in-container-ai-agents.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,28 @@ scope is later and optional (lines 9-21) is amended: in-container agents are wav
one. The non-goal wording superseded is in `docs/product.md`.
Nothing here authorizes orchestration, dispatch or board work.

## Open question: agent credentials (design input, not a decision)

Recorded 2026-10-15 as input for the credential design; nothing here is decided.

- Subscription CLIs (Claude Code, Codex, Antigravity) authenticate with an
interactive login, not an API key. A model gateway does not cover them; their
guardrails need a separate answer.
- For API-key use, a candidate pattern is an owner-run model gateway outside the
workspace. The gateway holds the provider keys; the workspace receives only a
base URL and a per-workspace virtual key, which gives budgets and
per-workspace attribution without provider keys in the container.
- A gateway only enforces this if workspace egress to the providers is
restricted to the gateway. That needs a network policy in the Docker
provider, which is undesigned; no workspace egress policy exists yet.
- WorkHarbor would expose a provider-neutral seam (gateway URL and key
reference) and would not bundle, deploy or configure a gateway.
- Candidates to evaluate, unverified:
[Busbar](https://github.com/GetBusbar/busbar) (self-hosted single binary,
six model protocols; its MCP/A2A governance is not yet demonstrated and its
config format is outside semver), [LiteLLM Proxy](https://github.com/BerriAI/litellm) and
[agentgateway](https://github.com/agentgateway/agentgateway).

## Consequences

[Product](../product.md) and [architecture](../architecture.md) state the wave-one
Expand All @@ -46,4 +68,4 @@ scoped exception needs owner action under its governance and is not made here.
The session interface contract ([#71](https://github.com/wstein/workharbor-nxt/issues/71)) and its wire format,
authorization binding and failure behavior are undesigned and belong to a
feature spec. Credential handling for agent
subscriptions is open. Nothing is implemented or verified.
subscriptions is open; see the open question above. Nothing is implemented or verified.