PR #160 · SPEC-C1 · Credential Vending
feat(harness): SPEC-C1 credential vending machine
What
Secure credential-vending Lambda that gives an ECS Fargate task short-lived AWS credentials scoped to exactly one turn and one user.
Why now
Workers need AWS access (S3 staging, DynamoDB journal, CloudWatch) but must not share broad roles or see other users' turns.
What changed
vend-credentials Lambda; STS AssumeRole with compact session policy; caller validation: HarnessTaskRole + task ARN + dispatch record; account-pinned set-operator checks; TagSession trust-policy support.
Risk / trade-off
A bug here is privilege escalation. Code validates every layer: caller identity, task ARN, dispatch row, user binding.
Money & ops
Replaces long-lived shared credentials with per-turn sessions. Enables secure multi-tenant Fargate isolation.
CEO decision
Approve. Recommend a second IAM review on session-policy tests before merge.