Design 24: the controller hands the vault only the covered accounts' values until the third milestone, and the break-glass recovery is below (review of ADR 0550's amendment)

2026-10-26 13:32:37 +01:00
parent 11b0a450c3
commit a3f6e967c0
1 changed files with 6 additions and 4 deletions
@@ -63,14 +63,15 @@ itself stay where they are made (ADR 0550 §1).
  authority's own on request, through its verb `sign`, for the callers its manifest names, and says `signed`
  naming the caller, the kind and the digest, never the key. The public halves are in a state of the vault that
  every node reads. The key and the authority leave the vault only as the one copy sealed to the operator key,
-  opened only in the break-glass recovery above, so losing the vault does not lose the key every signature
+  opened only in the break-glass recovery below, so losing the vault does not lose the key every signature
  depends on. Each node trusts the vault's key beside the controller's, one node first, and the controller's no
  more once it loses its lease (ADR 0550 §2).
 - **Licence grants and tokens.** The refresh tokens, the API key and the access tokens of every licence are vault
  secrets; the licence manager keeps which licence goes to which holder, and nothing secret
  ([39](39-the-anthropic-licence-manager.md), ADR 0550 §3).
- **Bus account passwords.** A bus account's value is the vault's, handed by the controller until ADR 0547's
-  third milestone and minted by the vault from then. The agent of the node holding `mesh-broker` hands the vault,
+- **Bus account passwords.** A bus account's value is the vault's: until ADR 0547's third milestone the controller
+  hands the vault the value of each account ADR 0374 §1 covers and keeps the others' values as today (ADR 0374
+  §4), whose hashes the vault adopts; from then the vault mints every one. The agent of the node holding `mesh-broker` hands the vault,
  sealed to it, the bcrypt hash of every user of the list the bus loaded; the vault adopts the hash of each user
  it holds no value for (the controller's own, the node and device accounts, the module and process accounts its
  values do not cover), writes it under `bus-accounts.<user>` and says `account-hashed` with `adopted: true`. It
@@ -129,7 +130,8 @@ adopted as modules (ADR 0078). A
 mesh has root secrets, so a mesh has a vault; it is not something a mesh opts into
 (ADR 0085, amended). It is provisioned the
 ordinary way. It does not yet mint the mesh's bus accounts: until the third milestone of ADR 0547 the
-controller mints them and hands each value to the vault, and from then the vault mints every one
+controller mints them, hands the vault each covered account's value (ADR 0374 §1) and keeps the others as
+today, and from then the vault mints every one
 (*Every secret lives in the vault*, below).

 There is **one vault per mesh**, on the control-node, reached from any node the way identity is.