Sidecat Connector custody
Status honesty: this is a draft design under active review, not shipped behavior. It is published because we design in public; expect it to change.
Agents are keyless, so when Sidecat talks to real services — model providers, and later things like a Figma connector — the credentials need a governed home in the daemon. The design treats a credential as what it is: standing authority over an external service, and standing authority is never assumed. A credential is admitted with every bound explicit — which endpoints, which purposes, a spend budget, a rotation deadline — and it suspends loudly when spent or expired. Re-admission is the rotation ceremony.
The one sanctioned absence
Sidecat's records normally treat absent bytes behind a hash as the cardinal failure. Connector custody inverts that deliberately, once: the secret's fingerprint lives in the records so use is auditable, and the secret bytes never do — validator-enforced, so the durable substrate is structurally incapable of leaking a credential through migration, observation, or future federation.
The grant seam
The admission's grant is a tagged shape: an API key today, an OAuth token tomorrow, an AAuth-style delegation when agent-native authorization standardizes. That last one is a recorded bet — the winning agent-auth layer will be delegation-, mission-, and audit-shaped, and the admission record is built so a new grant kind arrives under identical custody rather than a redesign.