Tyler King
944b3fde19
FastAPI companion service to the GSAP broker for AI agent
identity delegation in governed shell sessions.
Implements GCAP-SPEC-LLM-PRINCIPAL-BROKER-0001:
POST /delegate — request delegation (human → AI agent)
POST /delegate/{id}/revoke — revoke delegation
GET /delegate/{id} — delegation status
GET /agents — list active delegations
GET /health — health check
Delegation lifecycle:
REQUESTED → ACTIVE → EXPIRED | REVOKED
Cascading revocation on delegator AC revocation
Background cleanup of expired delegations (30s interval)
Keycloak integration:
Registers ephemeral agent clients per delegation
Deletes clients on revocation/expiry
Dev mode: stubs when no client_secret configured
GSAP broker integration:
Requests delegated ACs via on_behalf_of pattern
Scope narrowing: agent ceiling ≤ delegator ceiling
Dev mode: stubs when no bearer_token configured
Chronicle integration:
DELEGATION_CREATED (0x3001)
DELEGATION_REVOKED (0x3003)
DELEGATION_EXPIRED (0x3004)
All 7 smoke tests pass (health, create, list, query, revoke, verify, empty).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
21 lines
479 B
Text
21 lines
479 B
Text
# LLM Principal Broker — companion to fastapi-gsap
|
|
|
|
# Service
|
|
LLM_BROKER_PORT=8092
|
|
|
|
# GSAP Broker
|
|
GSAP_BROKER_URL=http://localhost:8000
|
|
GSAP_BEARER_TOKEN=
|
|
|
|
# Keycloak Admin
|
|
KEYCLOAK_URL=http://localhost:8080
|
|
KEYCLOAK_REALM=substrate
|
|
KEYCLOAK_ADMIN_CLIENT_ID=llm-broker-admin
|
|
KEYCLOAK_ADMIN_CLIENT_SECRET=
|
|
|
|
# Chronicle (optional — events posted as Forgejo push webhooks)
|
|
CHRONICLE_WEBHOOK_URL=
|
|
|
|
# Delegation Defaults
|
|
DEFAULT_DELEGATION_TTL_MINUTES=60
|
|
DEFAULT_MAX_COMMANDS=500
|