CAIN-INV-0826: Credential broker (CLAWX 21 section 20): agents get a CAPABILITY handle, never the secret

VERIFIED source compiles

Domain	AGENT_IDENTITY_AND_CAPABILITY
Tier	ENGINEERING_INNOVATION
Source	`clawx/messenger/credentials.py`
Mapped tests ran	208
Passed / failed / errored	208 / 0 / 0
Compiles	yes

Mapped tests

platform-gateway/test_acceptance_final.py

platform-gateway/test_cain_private_production.py

platform-gateway/test_cain_private_security.py

platform-gateway/test_capability_security.py

platform-gateway/test_security_attacks.py

platform-gateway/test_validated_trust_runtime.py

Generated 2026-10-06T19:15:35Z from git unknown. This page is a republication of the run result; it is not an independent audit.

Same-project verification only. The tests are authored in this repository; no third party has reviewed or reproduced these results. VERIFIED means the mapped tests passed in this run, not that the mechanism is independently correct.