Auth Guard

Enforce a deterministic auth path: one credential source, one helper command path, one startup check, one fallback policy.

Quick Workflow

1. 1. Identify the target service endpoint and current failing flow.
2. Define canonical credential source (env var first, credentials file second).
3. Create/update a helper script in workspace (.pi/) that always injects auth.
4. Add a startup/auth-check command that verifies credentials and endpoint access.
5. Update HEARTBEAT.md or AGENTS.md to require helper usage (ban raw unauthenticated calls).
6. Add explicit fallback behavior for unauthorized states.

Rules to Apply

• - Prefer ENV_VAR override, then ~/.config/<service>/credentials.json.
• Never embed secrets in logs, memory notes, or chat responses.
• Never call protected endpoints via raw curl if a helper exists.
• Keep fallback behavior explicit and low-noise.
• Store helper scripts in workspace/.pi/ for easy reuse.

Runtime Requirements

• - INLINECODE4
• INLINECODE5
• INLINECODE6

Check once before using this skill:

CODEBLOCK0

Safety Limits

• - Pass only trusted credential paths under ~/.config/<service>/... by default.
• Do not point --cred-file at arbitrary workspace files or unrelated secret stores.
• Keep probe URLs scoped to the target service auth endpoint.

Startup Auth Check Pattern

Run at session start (or before heartbeat loops):

CODEBLOCK1

Expected outcomes:

• - AUTH_OK → proceed with normal authenticated helper flow.
• INLINECODE10 or AUTH_FAIL_* → use defined fallback path and record one concise note.

Reusable Snippets

Use drop-in policy snippets from:

• - references/snippets.md (HEARTBEAT + AGENTS + helper policy blocks)

References

• - references/contract.md for the full Keychain Contract pattern
• INLINECODE14 for ready-to-paste operational snippets
• INLINECODE15 for multi-service usage examples (Moltbook, GitHub, Slack)