"""agent-credential-broker: capability layer between agents and a vault.

Invariant: agents may USE credentials through this broker, but can never
RETRIEVE credential values. Every operation resolves a stable reference
(``agent.ref`` custom field), enforces an item-scoped policy, executes a
bounded adapter, and returns only sanitized metadata.
"""

__version__ = "0.1.0"