3 Commits

Author	SHA1	Message	Date
didericis	fe9d05664c	docs: switch cred-proxy to sidecar shape ... Make the cred-proxy a per-bottle sidecar container on the bottle's internal docker network instead of a root-owned process inside the agent container. The boundary becomes container namespace separation, matching pipelock and git-gate. Update summary, problem, goals, in-scope, architecture diagram, components, existing code touched, external deps, and open questions; add a "Considered alternatives" section recording the rejected in-container shape.	2026-05-13 00:40:16 -04:00
didericis	7dc3914abc	docs: align cred-proxy architecture diagram ... Trim one trailing space from the four arrow/HTTPS rows and add one dash to the bottle-container bottom edge so all box-bound lines are 68 columns.	2026-05-13 00:23:09 -04:00
didericis	2a687449d4	docs: add PRD 0010 for credential proxy ... Per-bottle reverse proxy that holds API tokens (Anthropic OAuth, GitHub PAT, Gitea PAT, npm) in a root-owned process; agent gets only URLs in its environ. AWS / SigV4 explicitly out of scope.	2026-05-13 00:18:55 -04:00