# `ExSandbox.Conformance.Credentials.Probe`
[🔗](https://github.com/FoundryStack/ex_sandbox/blob/v1.2.0/lib/ex_sandbox/conformance/credentials.ex#L54)

What a host supplies so the credentials group can attempt real connections.

Every callback performs an act against a **live** store. A probe that
simulates its answers makes this whole group meaningless, since the
findings this group exists to catch — a `REVOKE` that returns success while
revoking nothing, an ACL whose null value means "wide open" — are precisely
the ones no simulation reproduces.

# `credential`

```elixir
@type credential() :: term()
```

An opaque credential, as the host models it.

# `attempt_connection`

```elixir
@callback attempt_connection(credential(), ExSandbox.Sandbox.t()) ::
  {:ok, :connected} | {:refused, term()} | term()
```

Attempts `credential` against the store belonging to `sandbox`.

`{:ok, :connected}` when the connection succeeded, `{:refused, reason}` when
it was turned away. Anything else is inconclusive and fails the check —
"could not tell" is not evidence of isolation.

# `attempt_platform_connection`

```elixir
@callback attempt_platform_connection(credential()) ::
  {:ok, :connected} | {:refused, term()} | term()
```

Attempts `credential` against the platform's own database (`013-FR-009`).

# `read_credential`

```elixir
@callback read_credential(ExSandbox.Sandbox.t()) :: {:ok, credential()} | {:error, term()}
```

The credential belonging to this sandbox, as tenant code would read it.

# `rotate`

```elixir
@callback rotate(ExSandbox.Sandbox.t()) :: {:ok, credential()} | {:error, term()}
```

Rotates the credential in place, returning the new one.

`FR-020`: the sandbox must not be rebuilt or destroyed. A probe that
reprovisions here is answering a different question.

# `secret_value`

```elixir
@callback secret_value(credential()) :: String.t()
```

The secret string that must never appear in a log, record, or inspect.

---

*Consult [api-reference.md](api-reference.md) for complete listing*