diff --git a/host/src/cred/mod.rs b/host/src/cred/mod.rs
new file mode 100644
index 0000000..282e060
--- /dev/null
+++ b/host/src/cred/mod.rs
@@ -0,0 +1,3 @@
+//! The credentials manager (P2, plan §4.4): items, grants, requests and audit in the host,
+//! outside the world. Programs in the world never see secret values.
+pub mod script;
diff --git a/host/src/cred/script.rs b/host/src/cred/script.rs
new file mode 100644
index 0000000..1ed0a2c
--- /dev/null
+++ b/host/src/cred/script.rs
@@ -0,0 +1,48 @@
+//! The contract between the credential pipeline and the script runtime that runs item validators
+//! and transforms. `cred::v8` implements it; the pipeline (`cred::inject`) and its tests use it.
+//! It keeps v2 `jsrun::evaluate`'s behavior (see `~/world/plugins/cred/source/jsrun/`).
+
+/// Requested limits. The runtime clamps them: time 1..1000 ms (default 100), heap 256 KiB..32 MiB
+/// (default 8 MiB).
+#[derive(Clone, Copy, Debug, Default)]
+pub struct Limits {
+    pub max_time_ms: Option<u64>,
+    pub max_memory_bytes: Option<usize>,
+}
+
+/// Stable error categories, independent of the engine's exception wording.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ErrorKind {
+    /// Time or heap limit exceeded.
+    Limit,
+    Syntax,
+    /// The script threw or its Promise rejected.
+    Throw,
+    /// The result is not JSON-serializable.
+    NonJson,
+    Engine,
+}
+
+/// An evaluation failure. The message can contain script-provided text.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Error {
+    pub kind: ErrorKind,
+    pub message: String,
+}
+
+/// Evaluate an item's script. `source` is an ES module. `export` names the function to call
+/// (`None` means `default`). The function gets the parsed `input` JSON as its one argument and may
+/// return a Promise. The result is `JSON.stringify` of the settled value.
+///
+/// Each call runs in fresh state, with the limits applied to compile, run and serialization. The
+/// script has `atob` and `btoa` only: no network, file system, timers, module loader, `Date` or
+/// `Math.random`. Implementations must be callable from any thread.
+pub trait Script: Send + Sync {
+    fn evaluate(
+        &self,
+        source: &str,
+        input: &str,
+        export: Option<&str>,
+        limits: Limits,
+    ) -> Result<String, Error>;
+}
diff --git a/host/src/lib.rs b/host/src/lib.rs
index 1f1056f..d2182e3 100644
--- a/host/src/lib.rs
+++ b/host/src/lib.rs
@@ -1,6 +1,7 @@
 //! The Sausage v3 host: a world folder behind a virtual filesystem, WASI programs in a process table,
 //! and the durable agent harness. See `~/research/sausage-v3/PLAN.md` until the docs move here.
 
+pub mod cred;
 pub mod exec;
 pub mod harness;
 pub mod process;