docs: a credential spec, and the two designs that answer to it - #199

How bravebot gets capabilities that need a secret, email first, without
ever holding one. Extends Brave Vault rather than adding a second broker:
its agent-access plan already states the principles, so the work is
hardening its storage and adding a service-token item type and a perform
action.

Six phases, 34 tests, and three limits stated rather than glossed: the
approval boundary does not hold against a same-uid attacker, encryption
at rest covers a stolen disk only, and none of it retrofits credentials
already on the machine.

…the capability inventory

The ladder moved out to the spec draft and left five references behind
with nothing to resolve against. Restates the four rungs compactly here.

The per-capability inventory went with it, so nothing said what source
control, cloud, payments or protocol servers actually need, or why a card
number is the worst-designed credential an agent could hold.

…c's tiers

Renames credentials.md to credential-brokering.md. It pairs with the
discovery design and says what the document decides rather than restating
its subject.

The rung ladder becomes the four named tiers. Two numbering schemes for one
ladder put "rung 1 is best" beside "gate 1 is the first failure", pointing
in opposite directions. The two paths follow: the broker performing an
action whole is Performed rather than Delegated, because substitution
reaches Delegated too, and naming one path after the tier implied the other
did not.

Binds the vocabulary the rest of the work uses: the broker is the authority
and the performer. Neither word appeared in this document before.

Smaller corrections. The tier table's subject is the account, not the
agent, which is the boundary the adversary model turns on. Each row of what
this does not cover says which of the two conditions it fails. The
capability inventory says up front that only email is in scope for the
phases below. Phases 5 and 6 are marked as carrying no tests.

Where credentials come from, which of them may be held at all, and what a
tier binds: four tiers, three gates, and a walk that records which of the
gate's conditions failed and whether the counterparty refused or nobody
attempted it. Separate from labels.md because the typed credential never
becomes a labelled value, so the flow control has no opinion about one,
which is also the answer to why the agent is not simply given the secret.

Twenty-five clauses. The safehouse comparison is what carries that answer:
three of the properties its credential gate rests on hold here too, and
the four that fail all reduce to an open tool surface over a local tree.
Three limits stated rather than glossed: substitution matches a performer
on custody and not on authority, detection sizes a brief window without
setting a tier, and nothing here is implemented.

The two paths were described as equivalent because the agent holds nothing
in both. That is true of custody and not of authority: the egress boundary
matches on host, so it bounds where a request goes and never which
operation it asks for. A performer exposes one action; a substituted
credential exposes everything the far end accepts at that destination.

Which gives the rule that decides between them. Substitution is safe where
the issuer bounds the dimension the boundary cannot see. `git push` passes,
because the repository is in the path and a GitHub App token is minted for
one of them. Email fails, because no provider will scope a token to a
recipient, so only something that reads the envelope can bound one.

Adds a diagram for setup and one per message, so the one consent and the
one approval are visible, and a worked example of the substituted path,
which phase 4 did not have. Writing it out found two things the phase has
to settle: a push's credential sits inside a base64 value rather than in a
header, which the position rule does not cover, and the boundary has to
terminate the push's TLS to reach it at all.

Tier rows, lifetimes and two rows of what this does not cover now agree
with the spec rather than restating it loosely. The architecture diagram
no longer draws a child's proxy as a boundary the text calls advice.