@baselineos/vault — Credential Vault

Encrypted, scoped, auditable credential management for AI agents.

What It Does

The Vault ensures credentials are never exposed in plaintext, never scattered across repos, and always audited:

• AES-256-GCM encryption at rest with per-credential IV, AAD binding, and legacy CBC migration
• Scoped access — per-agent, per-workflow, per-role credential boundaries
• Trust-score gating — low-trust agents cannot access high-sensitivity credentials
• Opaque leases — Agents receive lease IDs, never raw values
• Audit trail — Every access (granted or denied) logged to SQLite
• Health monitoring — Expired, unused, and missing credentials surfaced

GTCX Evidence Runner Boundary

Baseline Vault can support GTCX credentialed intelligence smoke runs as a trust-gated cache, but it is not the system of record for EAP customer keys.

| Plane | Direction | System of record | BaselineOS role | |---|---|---|---| | Protocol 19 | GTCX -> providers | Baseline Vault (~/.baseline/vault) | @baselineos/vault, MCP baseline_vault, trust-gated leases | | Protocol 23 / EAP | Customers -> GTCX | AWS Secrets Manager | Optional cache alias for CI/smoke evidence only |

Use the cache taxonomy external_evidence_cache for smoke-only aliases that resolve provider credentials for evidence runners. These aliases are for wrappers such as gtcx-agentic intelligence smoke scripts; they are not customer credential issuance records, EAP source-of-truth records, or production custody guarantees.

Operator pattern:

1. Import smoke credentials into Baseline Vault with baseline vault store or through the approved gtcx-agentic wrapper.
2. Trim local env files after import; keep only BASELINE_MASTER_KEY where the wrapper requires vault unlock.
3. Run evidence wrappers that resolve the vault-backed env in memory and do not echo secrets.
4. Rotate any staging key that was pasted into chat or logs, then re-import after EAP issue/sync.

Out of scope for this package:

• EAP issuance HTTP API; that belongs in gtcx-core / @gtcx/eap.
• AWS Secrets Manager as customer-key system of record; that belongs to Protocol 23.
• Kubernetes route/auth fixes for staging evidence services.
• Automatic rotation of GTCX provider keys after chat/log exposure.

CLI Import

Use the CLI when an operator needs to add or rotate a provider token locally:

baseline vault store CLOUDFLARE_API_TOKEN \
  --provider cloudflare \
  --type api-key \
  --min-trust-score 85

The default path prompts with no terminal echo. Non-interactive imports can use --from-env <VAR> or --stdin; neither path prints the secret value.

API

import { CredentialVault } from '@baselineos/vault';

const vault = new CredentialVault({
  persistPath: '.baseline/vault',
  masterKey: process.env.BASELINE_MASTER_KEY,
});
await vault.initialize();

// Store
vault.store('anthropic-key', process.env.ANTHROPIC_API_KEY, {
  type: 'api-key',
  scope: 'global',
});

// Retrieve (audited)
const key = vault.retrieve('anthropic-key', {
  agentId: 'planner-1',
  trustScore: 75,
});

// Issue opaque lease
const lease = vault.issueLease('anthropic-key', { agentId: 'planner-1' }, 60_000);

Package Boundary

This package owns:

• Credential encryption and decryption (AES-256-GCM + PBKDF2)
• Scoped access control
• Lease lifecycle (issue, resolve, revoke)
• Audit logging
• Health metrics
• Vault-managed attestation keys (Ed25519)

It does not own:

• Key rotation scheduling (Enterprise layer)
• Shamir secret sharing (Key Recovery in baselineos core — demonstration only, not production)
• Field-level encryption (Field Encryption in baselineos core)

License

Apache-2.0