abkslmandClaude Fable 5
fb826bbcf1
Finishes ANTIMATTER_RUNNER §6 / §0.2 item 5 — both directions of the credential mesh, replacing the smoke stand-in with production device code. Device providing (CredentialProvider, NucleicCore): captures the Mac's login credentials (Keychain OAuth via ClaudeLoginKeychain, managed token via GitHubCredentialStore), gossips a CredentialManifest — now carrying the device's own sealing key (additive CredentialManifest.sealingPublicKey) so a runner can seal updates back — and seals its held kinds to a runner's key answering credentialNeeded. PeerClient.setCredentialHandlers routes all three (manifest push on connect to a canReceiveSealedCredentials peer, seal-on-credentialNeeded, land-on-credentialUpdate) into AppStore. Mirror-back (runner → device, the syncClaudeLoginBack analogue): a session's CLI refreshes the OAuth token in place; a 30s digest-gated sweep in nucleicd (AppStore.mirrorRefreshedCredentials) seals the rotation to each connected device's sealing key and pushes credentialUpdate; the device reconciles it newest-wins into its Keychain (CredentialProvider.landUpdate → ClaudeLoginKeychain.shouldWriteBack). RunnerCredentialVault gains the current-plaintext read, the change digest, and mirrorBackEnvelope; SyncHost gains pushCredentialUpdate; ConnectionHandler gains deliverCredentialUpdate. Refresh lease: AppStore.credentialRefreshHolder arbitrates devices' gossiped leases with CredentialRefreshLease.merged (earliest live claim wins), so at most one device advances a rotating token; the runner's own session CLI is the de-facto refresher and the digest-gated mirror-back keeps everyone coherent. Verified: device→runner E2E over the production relay (runner asked, provisioned, files landed 0600, real claude turn authenticated); the runner→device reverse-seal + AAD binding + digest change-gate unit-tested (CredentialMeshTests, 3 tests); Darwin app + iOS builds; 171 protocol tests green on Linux; sync suites green. Remaining of item 5 is mechanical (doc'd): more kinds (codex/grok/API keys) and a Mac UI surface for what it shares. Co-Authored-By: Claude Fable 5 <[email protected]>