[czpython]

What changes

create_host sends secrets.

• Secret(value, *, host, auth_variable, auth_header, auth_prefix) is a value the caller holds. Issuer(url, headers, refresh, *, ...) is a URL Drukbox fetches the value from. Both are frozen records, like the other records. The custom service fields are keywords, and each record sends only the fields the caller set.
• create_host(secrets={...}) maps a service name to one of them. The response carries no secret, and SandboxHost does not change.
• A 409 for a deployment without the secrets proxy maps to SandboxConflictError. A 422 for a service name Drukbox does not know maps to SandboxValidationError. Both mappings existed, and their docstrings name the new causes.
• The http-proxies methods stay.
• The README shows the surface. AGENTS.md only lists the records in the layout. Version 0.2.0.

Where this differs from the ticket

• The ticket lists endpoint_var and base_path among the custom service fields. The service dropped both when the secrets proxy replaced the path route, so the wire contract has four custom fields, and the SDK sends those four.
• The ticket maps a 422 for "a service the exchange cannot route". That rule went with the path route. The 422 that remains is for a service name Drukbox does not know, and it maps the same way.

Names

New names, open to change: Secret, Issuer, their entry, and the base _Service with get_service, which holds the four custom fields for both.

Gates

uv run ruff check, uv run ruff format --check, uv run pyright, and uv run pytest are green.

Acceptance

Through the SDK, from the Mac, against a docker-sbx deployment of the current service on the KVM bed, with a dummy issuer that served a fake value, since provisioning never validates one:

• create_host with an issuer-backed anthropic secret returned an active host.
• Neither the create nor the get_host record carries a secret.
• A Secret for a service name Drukbox does not know raised SandboxValidationError with the service's message.
• delete_host completed.

5 of 5, and the bed restored.

Review

The adversarial review reported two findings. Both are applied:

• The records' generated repr showed the value and the issuer headers, so a log line with the secrets map exposed both. Those two fields are out of the repr now, and a test keeps them out.
• The custom field filter dropped an empty auth_prefix, which Drukbox reads as "no prefix", so a raw API key would have gone out as a bearer. The filter drops None only now, with a test for both records.