Search all skarbiec documentation

The release contains the bridge#

Skarbiec 0.3.8 packages the dependency-pinned Weles client under share/skarbiec/weles-client. When SKARBIEC_WELES_CREDENTIAL_COMMAND is unset, Skarbiec resolves its actual executable, including an installed symlink, and selects bin/weles-skarbiec-acquire-admission.mjs from that package. Node.js with Fetch must be available to the service.

SKARBIEC_WELES_CREDENTIAL_COMMAND remains an explicit choice of bridge. It must be an absolute, owner-controlled executable regular file, not a symlink. An invalid explicit choice is refused; it does not select the packaged transport instead. An incomplete release reports the exact missing packaged executable.

Three separate grants#

The canonical Skarbiec service calls Weles as skarbiec-weles-credential-client. That consumer requires audience weles and call:weles#credential-operations. The packaged bridge reads its owner-only ~/.stado/skarbiec-weles-credential-client-token file. WELES_TOKEN_FILE selects another explicit owner-only file; WELES_TOKEN supplies an explicit bearer.

Weles verifies each caller through Skarbiec using its separate weles-credential-admission consumer, introspect:tokens grant, and weles-credential-admission-skarbiec-token file. Revocation takes effect on the next call without restarting Weles.

The provider writer has only the exact stage:item#field capability required for acquisition. For a generic winston item this is winston-writer with stage:winston#api_key. The acquisition's --consumer names that writer, not the eventual application reader. A stage grant does not grant read access or prove that the provider interaction succeeded.

Discovery belongs to Stado#

The bridge reads weles-admission.local from STADO_FORWARDS_DIR or ~/.stado/forwards. It accepts one owner-controlled regular file containing the declared service address. Stado supplies the host and port; the bridge selects the fixed /api/v1/credential-operations route. Only HTTPS or loopback HTTP is accepted. There is no environment URL or guessed service port.

POST /api/v1/credential-operations accepts the exact skarbiec.credential-operation.v3 request for submit and status. The self-hosted route is separate from organization-authenticated hosted tasks and the Spis browser-task service. Their bearers cannot substitute for its credential-operation grant.

Shell

skarbiec credential acquire winston \
  --consumer winston-writer \
  --purpose 'Qualify the requested writing styles within the free API allowance' \
  --signup-origin https://dev.gowinston.ai \
  --as skryba-detector-onboarding \
  --token-file ~/.stado/skryba-detector-onboarding-token

skarbiec credential status winston \
  --as skryba-detector-onboarding \
  --token-file ~/.stado/skryba-detector-onboarding-token

Status names observed work#

Weles binds a request ID to the authenticated caller and the exact provider, item, field, writer, origin, operation and baseline. A changed request cannot reuse that ID. Status reads its persisted record and exact action log. A missing forward or authority is never represented as a queued operation.

An interrupted executor is not replayed after restart. Uncertain transport or provider effects remain unknown rather than being marked unchanged. For generic acquisition, Weles requires the matching acknowledgement written after Skarbiec accepted capture. A child process exit code alone is not proof. Skarbiec separately verifies the managed write against its active operation journal before settling acquisition.

The self-hosted transport accepts submit and status. It explicitly refuses resume with WELES_CREDENTIAL_MODE_REFUSED; the hosted task bridge has a separate approval continuation contract. A refused or unverified provider flow is not a completed acquisition.

Admission diagnostics
Code	Meaning
`WELES_ENDPOINT_UNRESOLVED`	The declared forward is missing or unsafe. No provider operation was submitted.
`WELES_CREDENTIAL_BEARER_UNRESOLVED`	The bridge cannot read its own caller bearer.
`WELES_CREDENTIAL_AUTH_UNCONFIGURED`	Weles cannot load its separate introspection authority.
`WELES_CREDENTIAL_SCOPE_REFUSED`	The caller lacks the exact audience or credential-operation capability.
`WELES_CREDENTIAL_REQUEST_CONFLICT`	A request ID is already bound to another caller or request.
`WELES_CREDENTIAL_EXECUTION_INTERRUPTED`	No durable final executor result exists; Weles did not replay the operation.
`WELES_CREDENTIAL_RESULT_UNCONFIRMED`	The run did not establish a matching capture acknowledgement.

Real release qualification#

The native release build runs the real compiled Skarbiec CLI through an installed symlink, with its pinned Weles package and an isolated GPG vault. With no Weles forward it must persist needs_configuration and WELES_ENDPOINT_UNRESOLVED without creating a provider credential. The command, exit status, response and persisted status are retained under target/credential-bridge-tests.

The Weles deployed admission journey checks real caller authentication, exact-writer refusal, persisted unsupported-operation status and request-ID conflict. These refusal results are not proof of successful provider acquisition. A live acquisition and the consuming application's real flow still have to pass.