Implement provisioned credentials

Add model.use and provisioned_credentials wire support, runtime credential lifecycle SPI, revocation stores, client credential access, TCK coverage, docs, and example.

Closes #15

Author: nficano

CONFORMANCE.md

@@ -81,6 +81,10 @@ works" is decomposed into multiple binary rows.
 | §9.6 `BigDecimal` arithmetic via Jackson `USE_BIG_DECIMAL_FOR_FLOATS` | Implemented | [ArcpMapper.create](arcp-core/src/main/java/dev/arcp/core/wire/ArcpMapper.java) |
 | §9.6 Negative metric values rejected | Implemented | [BudgetCounters.decrement](arcp-runtime/src/main/java/dev/arcp/runtime/lease/BudgetCounters.java) returns without decrementing |
 | §9.6 `BUDGET_EXHAUSTED` surfaced before authorize-bearing op | Implemented | [JobContext.authorize](arcp-runtime/src/main/java/dev/arcp/runtime/agent/JobContext.java) + `BudgetCounters.ensureAllPositive` |
+| §9.7 `model.use` enforcement | Implemented | [LeaseGuard.authorizeModel](arcp-runtime/src/main/java/dev/arcp/runtime/lease/LeaseGuard.java) delegates to generic lease authorization |
+| §9.7 `model.use` lease subsetting | Implemented | [Lease.contains](arcp-core/src/main/java/dev/arcp/core/lease/Lease.java) covers narrowed model patterns |
+| §9.8 provisioned credentials wire shape | Implemented | [Credential.java](arcp-core/src/main/java/dev/arcp/core/credentials/Credential.java) + [JobAccepted.java](arcp-core/src/main/java/dev/arcp/core/messages/JobAccepted.java) |
+| §9.8 credential lifecycle (issue/revoke/rotate) | Implemented | [CredentialProvisioner.java](arcp-runtime/src/main/java/dev/arcp/runtime/credentials/CredentialProvisioner.java) + [CredentialBinding.java](arcp-runtime/src/main/java/dev/arcp/runtime/credentials/CredentialBinding.java) |
 
 ## §10. Delegation
 
@@ -118,6 +122,7 @@ works" is decomposed into multiple binary rows.
 | lease-expires-at | Implemented | [examples/lease-expires-at/](examples/lease-expires-at/) |
 | idempotent-retry | Implemented | [examples/idempotent-retry/](examples/idempotent-retry/) |
 | custom-auth | Implemented | [examples/custom-auth/](examples/custom-auth/) |
+| provisioned-credentials | Implemented | [examples/provisioned-credentials/](examples/provisioned-credentials/) |
 
 ## §14. Security Considerations
 
@@ -126,6 +131,8 @@ works" is decomposed into multiple binary rows.
 | §14 Subscribe scope (no cross-principal leak) | Implemented | [SessionLoop.handleSubscribe](arcp-runtime/src/main/java/dev/arcp/runtime/session/SessionLoop.java) |
 | §14 Budget bypass protection | Implemented | [BudgetCounters.ensureAllPositive](arcp-runtime/src/main/java/dev/arcp/runtime/lease/BudgetCounters.java) gates every authorize call |
 | §14 Lease clock check (no past `expires_at`) | Implemented | [LeaseGuard.authorize](arcp-runtime/src/main/java/dev/arcp/runtime/lease/LeaseGuard.java) |
+| §14 Credential confidentiality | Implemented | [Credential.toString](arcp-core/src/main/java/dev/arcp/core/credentials/Credential.java) redacts `value`; [JobSummary](arcp-core/src/main/java/dev/arcp/core/messages/JobSummary.java) omits credentials |
+| §14 Credential revocation reliability | Implemented | [FileCredentialRevocationStore](arcp-runtime/src/main/java/dev/arcp/runtime/credentials/FileCredentialRevocationStore.java) records outstanding IDs; [ArcpRuntime.Builder](arcp-runtime/src/main/java/dev/arcp/runtime/ArcpRuntime.java) requires a configured revocation store when advertising credentials |
 | §14 Host-header / Origin allowlist on WS upgrade | Implemented | [ArcpJakartaAdapter](arcp-middleware-jakarta/src/main/java/dev/arcp/middleware/jakarta/ArcpJakartaAdapter.java) Builder.allowedHosts / allowedOrigins; [ArcpVertxHandler](arcp-middleware-vertx/src/main/java/dev/arcp/middleware/vertx/ArcpVertxHandler.java) Builder.allowedHosts; Spring adapter at the [ArcpSpringBootProperties](arcp-middleware-spring-boot/src/main/java/dev/arcp/middleware/spring/ArcpSpringBootProperties.java) level |
 
 ## Out-of-scope for 1.0.0

arcp-client/src/main/java/dev/arcp/client/JobHandle.java

@@ -1,10 +1,13 @@
 package dev.arcp.client;
 
+import dev.arcp.core.credentials.Credential;
 import dev.arcp.core.events.EventBody;
+import dev.arcp.core.error.ArcpException;
 import dev.arcp.core.ids.JobId;
 import dev.arcp.core.messages.JobAccepted;
 import dev.arcp.core.messages.JobResult;
-import dev.arcp.core.error.ArcpException;
+import java.util.List;
+import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Flow;
 
@@ -17,6 +20,10 @@ public interface JobHandle {
 
     JobAccepted accepted();
 
+    default Optional<List<Credential>> credentials() {
+        return Optional.ofNullable(accepted().credentials());
+    }
+
     /** Hot publisher of {@link EventBody} for this job's {@code job.event} stream. */
     Flow.Publisher<EventBody> events();
 

arcp-core/src/main/java/dev/arcp/core/capabilities/Feature.java

@@ -12,6 +12,8 @@ public enum Feature {
     SUBSCRIBE("subscribe"),
     LEASE_EXPIRES_AT("lease_expires_at"),
     COST_BUDGET("cost.budget"),
+    MODEL_USE("model.use"),
+    PROVISIONED_CREDENTIALS("provisioned_credentials"),
     PROGRESS("progress"),
     RESULT_CHUNK("result_chunk"),
     AGENT_VERSIONS("agent_versions");

arcp-core/src/main/java/dev/arcp/core/credentials/Credential.java

@@ -0,0 +1,39 @@
+package dev.arcp.core.credentials;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.Objects;
+import org.jspecify.annotations.Nullable;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public record Credential(
+        CredentialId id,
+        CredentialScheme scheme,
+        String value,
+        String endpoint,
+        @Nullable String profile,
+        @Nullable CredentialConstraints constraints) {
+    @JsonCreator
+    public Credential(
+            @JsonProperty("id") CredentialId id,
+            @JsonProperty("scheme") CredentialScheme scheme,
+            @JsonProperty("value") String value,
+            @JsonProperty("endpoint") String endpoint,
+            @JsonProperty("profile") @Nullable String profile,
+            @JsonProperty("constraints") @Nullable CredentialConstraints constraints) {
+        this.id = Objects.requireNonNull(id, "id");
+        this.scheme = Objects.requireNonNull(scheme, "scheme");
+        this.value = Objects.requireNonNull(value, "value");
+        this.endpoint = Objects.requireNonNull(endpoint, "endpoint");
+        this.profile = profile;
+        this.constraints = constraints;
+    }
+
+    /** §14: never log or expose the bearer secret through object rendering. */
+    @Override
+    public String toString() {
+        return "Credential[id=" + id + ", scheme=" + scheme + ", endpoint=" + endpoint
+                + ", profile=" + profile + ", value=REDACTED]";
+    }
+}

arcp-core/src/main/java/dev/arcp/core/credentials/CredentialConstraints.java

@@ -0,0 +1,18 @@
+package dev.arcp.core.credentials;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.time.Instant;
+import java.util.List;
+import org.jspecify.annotations.Nullable;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public record CredentialConstraints(
+        @JsonProperty("cost.budget") @Nullable List<String> costBudget,
+        @JsonProperty("model.use") @Nullable List<String> modelUse,
+        @JsonProperty("expires_at") @Nullable Instant expiresAt) {
+    public CredentialConstraints {
+        costBudget = costBudget == null ? null : List.copyOf(costBudget);
+        modelUse = modelUse == null ? null : List.copyOf(modelUse);
+    }
+}

arcp-core/src/main/java/dev/arcp/core/credentials/CredentialId.java

@@ -0,0 +1,25 @@
+package dev.arcp.core.credentials;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
+import java.util.Objects;
+
+public record CredentialId(@JsonValue String value) {
+    public CredentialId {
+        Objects.requireNonNull(value, "value");
+    }
+
+    public static CredentialId of(String v) {
+        return new CredentialId(v);
+    }
+
+    @JsonCreator
+    public static CredentialId fromJson(String v) {
+        return new CredentialId(v);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+}

arcp-core/src/main/java/dev/arcp/core/credentials/CredentialScheme.java

@@ -0,0 +1,29 @@
+package dev.arcp.core.credentials;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
+import java.util.Arrays;
+
+public enum CredentialScheme {
+    BEARER("bearer");
+
+    private final String wire;
+
+    CredentialScheme(String wire) {
+        this.wire = wire;
+    }
+
+    @JsonValue
+    public String wire() {
+        return wire;
+    }
+
+    @JsonCreator
+    public static CredentialScheme fromWire(String wire) {
+        return Arrays.stream(values())
+                .filter(scheme -> scheme.wire.equals(wire))
+                .findFirst()
+                .orElseThrow(() -> new IllegalArgumentException(
+                        "unknown credential scheme: " + wire));
+    }
+}

arcp-core/src/main/java/dev/arcp/core/credentials/package-info.java

@@ -0,0 +1,4 @@
+/**
+ * Wire types for ARCP §9.8 provisioned credentials.
+ */
+package dev.arcp.core.credentials;

arcp-core/src/main/java/dev/arcp/core/error/BudgetExhaustedException.java

@@ -1,6 +1,6 @@
 package dev.arcp.core.error;
 
-public final class BudgetExhaustedException extends NonRetryableArcpException {
+public class BudgetExhaustedException extends NonRetryableArcpException {
     public BudgetExhaustedException(String message) {
         super(ErrorCode.BUDGET_EXHAUSTED, message);
     }

arcp-core/src/main/java/dev/arcp/core/error/UpstreamBudgetExhaustedException.java

@@ -0,0 +1,16 @@
+package dev.arcp.core.error;
+
+import org.jspecify.annotations.Nullable;
+
+public final class UpstreamBudgetExhaustedException extends BudgetExhaustedException {
+    private final @Nullable String upstreamResponseBody;
+
+    public UpstreamBudgetExhaustedException(String message, @Nullable String upstreamResponseBody) {
+        super(message);
+        this.upstreamResponseBody = upstreamResponseBody;
+    }
+
+    public @Nullable String upstreamResponseBody() {
+        return upstreamResponseBody;
+    }
+}