Interface AdapterEnvelopeInput

Route origin, without a trailing slash. The adapter appends its own path.

The exact bytes a signed request/header row committed to.

Transmit verbatim. Appending, re-serialising or "fixing" them breaks the commitment and turns a later derivation into a false tamper alarm.

The credential value, resolved for THIS request through the credentials seam, or null when the route configures none.

Null is legitimate: a local model server has no key, and requiring a reference that resolves to nothing would mean recording a credential the deployment does not have. What is never legitimate is an adapter reading one from anywhere else.

Route-pinned headers — an agent id, a tenant, an API version override.

The model, for adapters whose URL carries it. The BODY already names it.