claustrum is the CortexKit credential vault: a daemon, run under the CortexKit supervisor, that holds OAuth tokens, API keys, session cookies and signing keys encrypted at rest, refreshes OAuth credentials before they expire, and serves each consumer only the credential it is entitled to. One custody home means one refresher per OAuth grant, so two tools can never race each other into a provider's token-reuse detection, and every write is gated by the master key and recorded in a tamper-evident audit chain.
| crate or package | what it is |
|---|---|
crates/credentials-core |
Custody logic: records, encryption envelope, master-key resolution, encrypted store, refresh adapters, audit chain, signing. |
crates/credentials-module |
The daemon ck-claustrum and the operator CLI ck-auth (ck auth <verb>). |
crates/claustrum-client |
cortexkit-claustrum-client, the Rust client for supervised modules. |
packages/client |
@cortexkit/claustrum-client, the TypeScript client. |
packages/opencode |
@cortexkit/opencode-claustrum, an OpenCode plugin that serves provider slots from the vault. |
How the parts fit together, and the rules they keep, is in
docs/architecture.md.
These need only the Rust toolchain, Bun and Python 3; every published CortexKit crate comes from crates.io:
cargo check --workspace --locked
cargo test --workspace --locked --features credentials-core/test-support
python3 -m unittest discover -s scripts/tests
bun install
bun run build # required before the TypeScript packages can be imported
bun test packagesbun run build is not optional. @cortexkit/claustrum-client is a workspace package whose
main points into dist/, and dist/ is not committed, so on a fresh clone or a new
git worktree bun install succeeds and leaves the package unresolvable: imports fail with
Cannot find package '@cortexkit/claustrum-client', which reads like a missing dependency
rather than a missing build.
The full gate runs everything CI runs, with the feature flags and the expected test counts.
It also runs the real-daemon end-to-end tests and the inbound-contract check, which need a
checkout of subconscious beside this repository,
and ckdev-mutate installed (see mutation testing):
./scripts/gate.shSee CONTRIBUTING.md for what the gate checks and how to commit.
ck setup claustrum installs the vault. Releases from v0.1.3 need subc 0.17.20 or newer:
an older supervisor refuses the module's HELLO with
malformed HELLO body: missing field "consumes" and parks it after three restarts. That
message names a protocol field rather than a version mismatch, so upgrade the supervisor first.
This concerns you only if you install from the release page by hand; ck setup claustrum
installs the supervisor first.
- Operator runbook: install, master key, logins, grants and enrollments, backups and restore, key rotation, deploy and rollback.
- Wire contract: the consumer-facing read surface.
- Manifest signing: the
ghrouting-manifest signing ceremony. - Security policy: how to report a vulnerability, and the threat model.
MIT; see LICENSE.