Add durable credential registry and secret lifecycle

crates/remora-domain/src/ports.rs

@@ -42,14 +42,40 @@ pub trait IdentityProvider: Send + Sync {
     ) -> impl Future<Output = Result<Self::Principal, Self::Error>> + Send;
 }
 
+/// Resolve handle for one execution grant's pinned credential.
+///
+/// Carries only the grant identity. Resolvers must re-validate durable grant
+/// activity on every resolve; this type is not a substitute for that check and
+/// does not embed credential or version IDs that could be forged independently
+/// of grant state.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ActiveCredentialGrant {
+    grant_id: OpaqueId,
+}
+
+impl ActiveCredentialGrant {
+    /// Wrap an execution-grant identity for resolution.
+    ///
+    /// Security is enforced at resolve time against durable grant pin state, not
+    /// at construction. Unknown, revoked, or mismatched grants fail closed.
+    #[must_use]
+    pub fn for_execution_grant(grant_id: OpaqueId) -> Self {
+        Self { grant_id }
+    }
+
+    #[must_use]
+    pub fn grant_id(&self) -> &OpaqueId {
+        &self.grant_id
+    }
+}
+
 pub trait CredentialResolver: Send + Sync {
     type Error;
     type Secret;
 
     fn resolve(
         &self,
-        credential_id: &OpaqueId,
-        version_id: &OpaqueId,
+        access: &ActiveCredentialGrant,
     ) -> impl Future<Output = Result<Self::Secret, Self::Error>> + Send;
 }