`runtime auth`¶

Validate platform credentials. The runtime never issues or stores them — see Authentication for the model.

runtime auth status
runtime auth login <provider>
runtime auth logout <provider>

Providers: github, gcp, kubernetes, openshift.

`runtime auth status`¶

An unaudited health check across every enabled provider.

runtime auth status

Only providers with enabled: true in config.yaml are checked. A disabled provider costs nothing — no code path for it runs.

auth status is a diagnostic, not a prerequisite

There is no pre-flight auth check anywhere in the execution path. Nothing you run invokes auth status internally. Each execution validates the provider its operation needs, inline — so a capability's steps re-validate once per step. No session is established or reused.

For a fuller picture, including installed-binary checks and policy warnings, use runtime config validate.

`runtime auth login <provider>`¶

Validates one provider explicitly. Audited.

runtime auth login github
runtime auth login gcp
runtime auth login kubernetes
runtime auth login openshift

This is a validation, not an interactive login. The runtime never opens a browser and never starts a platform's login flow. If a session is missing or expired, the error names the command to run yourself:

gcloud auth application-default login
oc login --token=<token> --server=<url>
kubectl config use-context <name>

Per provider¶

githubgcpkubernetesopenshift

export RUNTIME_GITHUB_TOKEN=ghp_your_personal_access_token
runtime auth login github

Validated against GET <base_url>/user.

gcloud auth application-default login
runtime auth login gcp

Validated via gcloud auth print-access-token; the subject comes from gcloud config get-value account.

kubectl config use-context <name>
runtime auth login kubernetes

Validated by reading the kubeconfig's current-context directly — no shell-out, no kubectl dependency for the check itself.

oc login --token=<token> --server=<server>
runtime auth login openshift

Validated via oc whoami.

`runtime auth logout <provider>`¶

Audited. What it actually does depends on whether there is a session to end:

Provider	Behaviour
`gcp`	Genuinely revokes — `gcloud auth application-default revoke`
`openshift`	Genuinely ends the session — `oc logout`
`github`	Prints guidance. A personal access token has no server-side session; revoke it in GitHub settings and unset the variable
`kubernetes`	Prints guidance. A kubeconfig is a file, not a session

runtime auth logout gcp          # revokes ADC
runtime auth logout openshift    # ends the oc session
runtime auth logout github       # guidance only — still audited

The distinction is deliberate: the runtime will not pretend to revoke something it cannot revoke. Every attempt is audited either way.

Enabling a provider¶

All providers except github ship enabled: false. Enable one after logging in with the platform's own tooling:

authentication:
  gcp:
    enabled: true
    binary: gcloud

Or from the environment:

export RUNTIME_AUTHENTICATION_GCP_ENABLED=true

See config.yaml and GCP, Kubernetes, OpenShift.

Checking without side effects¶

runtime resolve auth login github

Confirms the command line resolves, without validating anything or writing an audit record.

runtime auth¶

runtime auth status¶

runtime auth login <provider>¶