[afourniernv]

Summary

Expose bounded credential-preparation outcomes as a request stage. Attach notable withholding, denial, unavailability and staleness metadata to the existing security record. Do not include tokens, secret values or exchange bodies, and retain endpoint and placement restrictions.

Stacked review 3/6. This draft targets the middleware-correlation draft in this fork; its diff contains only this layer, not the whole stack. The HTTP core is reviewed upstream in NVIDIA#5214; this dependent draft is on the author fork because upstream base branches are not available.

Related Issue

Closes NVIDIA#5395.
Tracking: NVIDIA#5210 (remains open).

Changes

• The local layer covers static and token-grant preparation paths while preserving current endpoint and placement checks.
• Configured credential preparation and withheld/denied/unavailable/stale cases are distinguishable on the correct request.
• No credential values, token claims or exchange bodies are exported.

Testing

• Exact credential layer: mise run pre-commit and final strict clippy passed; 1,652 network tests passed.
• Behavior tests added or retained for this layer; DCO-signed commit 123d9ba.
• Cumulative native Hermes/Relay live validation on source 0764c1c4c: 13 selected workflows, 1,552 spans and 433 OCSF records; protected synthetic APIs and authenticated GitHub. The agent executed actual tools; no span parents were rewritten. This is cumulative evidence, not isolated-layer E2E qualification.
• Cumulative mise run test rerun passed with four test threads. Initial unchanged VM cleanup and gateway fixture flakes passed isolated reruns and the final full run. Full mise run ci is not claimed.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant crate and observability documentation updated.
• Maintainer acceptance and upstream promotion, after the parent layer lands.

Tested upstream snapshot: 638974575 (merged NVIDIA#4789). Newer main has advanced; this draft does not claim validation against today's main. It is for incremental code review, not merge readiness. No Relay dependency or reverse workload-reporting endpoint is introduced.