2026-09-05 10:27:11 +00:00
1 changed files with 33 additions and 0 deletions
@@ -143,6 +143,39 @@ mesh's copy is a public key, so a copy of the mesh's database grants nothing. *C
 is compromise of that node* becomes true rather than aspirational, because the only secret on a
 machine is the one that identifies it.
 ### What "connecting to the mesh" is, concretely
 *Written 2026-08-29, because it was asked and this record had never said it.*
 **One outbound AMQP connection from the node to the broker, held open.** That is all of it. There
 is no second connection and nothing is ever dialled *at* a node. Being in the mesh, operationally,
 means that connection is up; being disconnected means it is not
 ([`09-the-node-lifecycle.md`](../03-DESIGN/01-to-be/09-the-node-lifecycle.md)).
 **Two different things ride on it, and conflating them is what made this confusing:**
 | | what it answers | who issues it |
 |---|---|---|
 | **an AMQP account** | may this connection be accepted at all | **the mesh, at enrolment** |
 | **the node's keypair** | which node is speaking, on every message | **the node**, above |
 **The account is the mesh's to issue**, and per node. The broker has to authenticate somebody
 before a connection exists, and a shared account would let any node consume another's queue —
 which is the shared-credential fault this record exists to remove, reappearing at the transport.
 So enrolment creates that node's account and hands it over, and it is rotatable without touching
 the node's identity.
 **The keypair is not made redundant by it.** With only an account, the control plane would know
 which node is speaking *because the broker says so* — and that is the same transitive authority
 this record refuses in the other direction. A compromised broker could then attribute reports to
 whichever node it liked, and the control plane would act on them. Signing is what removes the
 broker from the question in both directions.
 **So a node holds two things after enrolment**: a credential the mesh issued for reaching the
 broker, and a key it generated itself that the mesh only ever sees the public half of. Both are
 its own, neither reaches anything else, and *compromise of a node is compromise of that node*
 still holds.
 ### Its own key, not the machine's SSH host key
 Reusing the host key is the obvious economy and it is refused, for reasons that are operational