Module auth_provider 

RFC inbound authentication seam: the AuthProvider trait + a default-deny ProviderRegistry.

Each provider verifies ONE credential kind (OIDC token, SSH signature, peer uid, native pairing bearer) and emits a uniform zeroclaw_api::principal::Principal carrying the identity / claim inputs (the resolved ZeroClaw grants are added additively in the later IamPolicy-wiring step, not in this slice). Dispatch, audit, and per-principal isolation read that Principal and never see the credential, so they are provider-agnostic.

NOTE — name distinction: this AuthProvider (an inbound auth trait) is unrelated to zeroclaw_providers::auth’s AuthProvider enum, which names outbound LLM-provider OAuth kinds. They live in different crates and never coexist in one import scope.

This module is the foundational seam: it has no production call sites yet (the registry is empty until providers are constructed at gateway/RPC boot in a later phase), so it changes no runtime behaviour. Default-deny means an empty registry rejects everything — wiring it on is a deliberate, later step.

Structs

ProviderRegistry

The configured set of providers, consulted in order. Default-deny: if no provider accepts-and-authenticates the credential, the outcome is AuthOutcome::Denied. An empty registry rejects everything.

Enums

Credential

A credential presented for verification (the input to the initialize handshake). Secret material is redacted in Debug — never log it raw.

Traits

AuthProvider

An RFC authentication provider: verifies one credential kind and emits a uniform AuthOutcome. Implementations live beside their identity source (e.g. oidc next to the IdP introspection code, native over PairingGuard).